Johnson & Johnson Initiates Class I Recall of Impella Heart Pump Controllers Over Cybersecurity Risks

Johnson & Johnson’s Abiomed unit has issued a Class I recall of its automated Impella 2.5 heart pump controllers due to cybersecurity vulnerabilities that could compromise device performance. The devices, which help maintain blood flow during high-risk heart procedures or cardiac shock, remain on the market, and no patients have been harmed.

The FDA highlighted that the vulnerabilities pose an “unacceptable residual risk” affecting the controllers’ operating system. If exploited, they could lead to loss of device control or unexpected pump stops, potentially causing life-threatening injury or death.

Abiomed identified the issues during routine cybersecurity assessments. The risks are limited to the controller consoles and do not extend to hospital networks. Customers have been instructed to secure the devices and disable network capabilities, either with Abiomed’s guidance or by its field representatives. Security updates and mitigation measures are in development, with further instructions to be provided upon deployment.

19-10-2025