St Jude Medical Recalls Merlin PCS Programmer Firmware for Security
St Jude Medical is releasing new firmware for Merlin PCS programmers to strengthen security against unauthorized access to cardiac devices.
The agency’s classification
FDA (Devices): Class II
Class II is a situation in which use of or exposure to a violative product may cause temporary or medically reversible adverse health consequences, or where the probability of serious adverse health consequences is remote.
This is the agency’s own classification, taken from its notice. The severity score below is our assessment, not the agency’s. How recall classes work
What this means for you
Our assessment, not the agency’s: severity 3/5 (High).
Real risk of harm even if no illness or injury has been reported yet. Stop using the product and follow the agency's guidance.
Our severity reasoning: The recall addresses a security vulnerability in medical devices that could allow unauthorized access, representing a risk-of-harm product where injury has not yet been reported.
Plain-English summary
St Jude Medical Inc. is recalling the Merlin PCS programmer (Model # 3650) and associated Software (Model # 3330). The recall involves 71,651 units that were distributed nationwide in the United States. The affected software versions include 24.1.1 rev1 (US), 23.1.2 rev 1 (OUS), 23.1.3 (Japan), and 23.1.4 rev 1 (Canada).
The firm is releasing new firmware for high voltage implantable cardiac devices (ICD) and cardiac resynchronization therapy defibrillators (CRT-D). This update is intended to strengthen security by providing an additional layer of protection against unauthorized device access. For older generation devices that cannot accept the new firmware, the firm is advising customers of the option to permanently disable the RF communication capability in these devices.
The recalled product
- Product
- Merlin PCS programmer (Model # 3650), Software (Model # 3330)
- Manufacturer
- St Jude Medical Inc.
- Hazard
- Affected units
- 71,651
Is your product affected?
Check your packaging against the codes below. If any of them match, the product is part of this recall.
Lot numbers (4)
- Software Versions: 24.1.1 rev1 (US)
- 23.1.2 rev 1 (OUS)
- 23.1.3 (Japan)
- and 23.1.4 rev 1 (Canada)
Distribution
Distributed nationwide across the United States.
Part of a larger recall action
This product is one of 12 recalled by St Jude Medical Inc. under a single FDA (Devices) recall action. The agency files each product separately, so the size of the action is not visible from this page alone.
See all 12 products in this recall →Related recalls
Same manufacturer · St Jude Medical Inc.
See all →- SevereSt Jude Medical Recalls 15 Ellipse DR Cardioverter Defibrillators
FDA (Devices) · 2019-08-14
- SevereSt Jude Medical Recalls 42 Ellipse DR Cardioverter Defibrillators
FDA (Devices) · 2019-08-14
- SevereSt Jude Medical Recalls 47 Ellipse VR Implantable Cardioverter Defibrillators
FDA (Devices) · 2019-08-14
- SevereSt Jude Medical Recalls 27 Ellipse VR Implantable Cardioverter Defibrillators
FDA (Devices) · 2019-08-14
- SevereSt Jude Medical Recalls 21 Ellipse DR Implantable Cardioverter Defibrillators
FDA (Devices) · 2019-08-14
Same hazard · unauthorized access
See all →- HighBiometric Firearm Safes Recalled Due to Unauthorized-Access Hazard
CPSC · 2026-07-09
- HighFirearm chamber locks recalled because they can be forcibly removed
CPSC · 2025-09-04
- HighMUSE 5 Cardiovascular Systems Recall Administrator Credential Access
FDA (Devices) · 2025-06-18
- SevereLifeShield Infusion Safety Software Recalled for Drug Library Defects
FDA (Devices) · 2025-05-21
- HighGE Healthcare Cardiology CA1000 Security Vulnerability Could Allow Patient Data Access
FDA (Devices) · 2025-04-09
Similar recalls
- HighSt. Jude Medical Recalls Merlin PCS 3650 Programmer for Firmware Update
FDA (Devices) · 2017-10-25
- ModerateSt Jude Medical Recalls Merlin PCS Programmer Software for ICM Battery Display Error
FDA (Devices) · 2018-07-11
- HighMerlin 2 PCS MER3400 programmer software recalled by St. Jude Medical
FDA (Devices) · 2022-08-10
- HighSt. Jude Medical Recalls Merlin@Home Software for Pacemaker Security
FDA (Devices) · 2017-10-25
- HighMerlin PCS 3650 Programmer May Fail to Terminate Pacing Test Properly
FDA (Devices) · 2022-04-27
- HighSt. Jude Medical Merlin@home Transmitter Software Reset Recall
FDA (Devices) · 2015-01-21