The “revelation” that St. Jude Medical devices contain serious security flaws that could potentially be exploited by hackers to cause harm to patients has certainly ruffled a few feathers.
Late last month, MedSec Holdings Inc. provided detailed information to short-selling firm Muddy Waters about alleged security flaws in certain St. Jude defibrillators, pacemakers, and monitoring devices. The controversial move by MedSec has been criticized by many, who claim the information should have been provided to St. Jude to allow the company to investigate the claims and take action to mitigate any risk. However, St. Jude Medical was kept in the dark.
Muddy Waters used the information to short St. Jude stock and make a profit. Firms such as Muddy Waters borrow stock and sell it prior to an expected fall in prices. They then buy the stock back once the price has fallen. The stock is given back to the lenders, relevant charges are paid, and any profits are retained by the short-seller.
The Muddy Waters report claimed that serious security flaws in the medical devices could be easily exploited by malicious actors in order to cause harm to patients. If a hacker was to manipulate the devices by exploiting the security vulnerabilities, it could potentially have fatal consequences for the patient.
Since the Muddy Waters report was published, independent researchers have not been able to demonstrate it was possible to cause St. Jude devices to crash or malfunction. St. Jude has also said the claims in the report were misleading and false.
Now St. Jude has taken the logical next step and is suing Muddy Waters and MedSec for intentionally disseminating false information in order to manipulate stock prices and make a profit. Following the publication of the Muddy Waters report, St. Jude Medical stock prices fell by 10%, although they recovered 5% of their value by the end of the day. Currently, stock prices remain 3% lower than before the report was published.
Reuters reports that the lawsuit claims the Muddy Waters report and statements made by Carson Block were false and defamatory. St. Jude says in the suit that this was a “wilful and malicious scheme to manipulate the securities markets for their own financial windfall.”
The purpose of the lawsuit is to protect the company’s reputation and restore faith in the medical devices. Damages are being sought and St. Jude believes the defendants should forfeit any profits made from their investment.
Reuters reports that doctors appear to be relatively unperturbed by the revelations and are continuing to advocate the use of the devices, while a Food and Drug Administration investigation into the devices – which was conducted prior to the publication of the Muddy Waters report – has since been published. The FDA does not believe users of the devices are at risk and it still recommends patients continue to use the devices as instructed by their physicians.