‘Cyber Issue’ Leads to FDA Recall of Baxter Respiratory Gear

The Food and Drug Administration is warning that Life 2000 – an at-home ventilation system by medical device maker Baxter – has been permanently recalled due to a cyber issue that could allow individuals with physical access to tamper with the gear’s life support settings.

See Also: Frost Radar™ on Healthcare IoT Security in the United States

Baxter in April began notifying at-home patients about an unspecified cyber problem with their Life 2000 equipment, urging patients to reach out to their healthcare provider for therapy replacement options.

Baxter describes the Life 2000 as a portable, lightweight “mask-free non-invasive ventilator that is designed to provide breathing support to patients at home … as they go about their activities of daily living.”

The FDA did not immediately respond to Information Security Media Group’s request for additional details, including the timing of the agency’s recall alert on Nov. 26, considering Baxter had begun notifications to patients in April of a permanent recall.

“The FDA has identified this recall as the most serious type. This device may cause serious injury or death if you continue to use it,” the agency warned in its alert.

“Stop using Life 2000 ventilators. Patients should reach out to their healthcare provider to discuss replacement options. Do not leave ventilators unattended in public or unsecured areas.”

The FDA in its alert warned that due to the unspecified cyber issue, “if an unauthorized person were to gain physical access to the device while it is unattended, they could potentially change device therapy settings or access device data. This may lead to the life-supporting air delivery function not working as intended.”

The use of the Life 2000 product “may cause serious adverse health consequences, including injuries caused by device malfunction or complete failure of vital breathing support and death,” the FDA warned.

As of April 10, Baxter has reported no serious injuries or deaths associated with this issue, the FDA said.

Baxter did not immediately respond to ISMG’s request for additional details, including the nature of the “cybersecurity issue” discovered during “internal testing” that prompted the recall.

Life 2000 devices have been the subject of several earlier advisories and Baxter recalls for other issues, including one in July 2024 for a battery charger problem and an alert in November 2024 that did involve several vulnerabilities.

That included cleartext transmission of sensitive information, improper restriction of excessive authentication attempts, use of hard-coded credentials, improper physical access control, download of code without integrity check, on-chip debug and test interface with improper access control, missing support for security features in on-chip fabrics or buses, missing authentication for critical function, and insufficient logging.

“Successful exploitation of these vulnerabilities could lead to information disclosure and/or disruption of the device’s function without detection,” Baxter warned at the time.

It is unclear from the FDA and the Baxter recall alerts whether the current “permanent recall” involving the unspecified “cyber issue” is related to those earlier problems.

Phil Englert, vice president of medical device security at the Health Information Sharing and Analysis Center, said the FDA issuing an alert about a “permanent recall” for a cybersecurity issue is fairly uncommon.

“The potential risk to patients must be considered significant for a product to be removed from use and an alternate therapy mechanism implemented,” he said. “The FDA must have a valid concern for repeating the recall and removing the voluntary aspect of it. This action may instill a greater sense of urgency.”

Englert added that Baxter is generally viewed as “proactive in developing and delivering secure patient care technologies,” but that he is disappointed that neither the Baxter recall notice nor the FDA alert specifies the “cyber issue” at the center of the latest safety recall.

“Typically, safety recalls include section headers: clinical function, the patient population the device is intended to treat, the impact on that population should the device fail, the action to take, reason for the recall including impact of failure, and a feedback mechanism to the manufacturer,” he said.

“This information is essential for clinical staff to properly evaluate the cyber risks within the contact of clinical care and patient treatment.”