FDA Safety Communication – Symbiq Infusion System by Hospira: Cybersecurity Vulnerabilities

The FDA, the U.S. Department of Homeland Security’s Industrial Control Systems Cyber Emergency Response Team (ICS-CERT), and Hospira are aware of cybersecurity vulnerabilities associated with the Symbiq Infusion System.
The FDA strongly encourages health care facilities transition to alternative infusion systems, and discontinue use of these pumps.

Hospira and an independent researcher confirmed that Hospira’s Symbiq Infusion System could be accessed remotely through a hospital’s network. This could allow an unauthorized user to control the device and change the dosage the pump delivers, which could lead to over- or under-infusion of critical patient therapies. This infusion system can communicate with a Hospital Information System (HIS) via a wired or wireless connection over facility network infrastructures.