St. Jude, Activist Investor Lock Horns Over Cybersecurity Report

Stock trading was halted Friday as St. Jude issued a longer rebuttal to Muddy Waters Capital's claims that St. Jude implantable cardio devices have major cybersecurity problems.

Chris Newmarker 

St. Jude Medical on Friday accused activist investor firm Muddy Waters Capital and cybersecurity outfit MedSec of releasing a false and misleading report about the security of St. Jude devices. 

The report had sent St. Jude stock down nearly 5% in value on Thurday after its release. But investors seemed calmed Friday by St. Jude's announcement: St. Jude's stock was down another 3% for the day before trading temporarily halted in the afternoon for the announcement, after which the stock rebounded to its starting point for the day at roughly $78 per share. 

Such accusations from a short-selling, activist investment firm come at a delicate time for St. Jude Medical. Abbott Labs is in the process of acquiring St. Jude for $25 billion. Abbott officials have already become lukewarm over another merger they were planning: the $6 billion purchase of diagnostics company Alere, which is now suing Abbott to get the deal completed.

Muddy Waters and MedSec have claimed appalling security problems related to a host of St. Jude cardio devices. They mentioned demonstrations of two types of attacks against St. Jude implantable cardiac devices: a "crash" attack leading to device malfunction or even pacing at a dangerous rate, and a battery drain attack. The weak spot in St. Jude's device ecosystem is its Merlin@home home monitoring systems, which Muddy Waters and MedSec described as "keys to the castle."

The groups said in their report: "These units are readily available on Ebay, usually for no more than $35. Merlin@homes

generally lack even the most basic forms of security, and as this report shows, can be exploited to cause implanted devices to malfunction and harm users."

St. Jude on Friday offered a number of rebuttals to the report:

Muddy Waters in response described St. Jude's statement as a missed opportunity to take responsibility for the problems. 

Said Muddy Waters: "St. Jude's response shows that it appears to ignore the nature of the vulnerabilities and the attacks that we described in the report. It's statement offers false assurances that the devices are secure and we intend to publicly refute the company's desperate attempt to brush the issue aside once again. At the end of the day, the longer St. Jude fails to take responsibility for these issues, the greater the risk to their users."

Chris Newmarker is senior editor of Qmed. Follow him on Twitter at @newmarker. Editor-in-chief Jamie Hartford contributed to this report.

Like what you're reading? Subscribe to our daily e-newsletter.

[Image by Corwinhee - Own work, CC BY-SA 4.0]