Abbott Laboratories

Summary

Hackers penetrated the computer networks of three major U.S. medical device manufacturers—Medtronic, Boston Scientific, and St. Jude Medical—during the first half of the year, with intrusions potentially lasting several months. The attacks were described as "very thorough" and showed signs of originating from China, though the exact motive and scope remained unclear. Federal authorities notified the companies of the breaches, prompting each to form task forces to investigate. While no breach of patient information was disclosed, the incident highlighted the significant risk of intellectual property theft, as these companies hold valuable proprietary technology and sensitive clinical trial data. The FBI declined to comment on the matter.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

In the first half of 2013, hackers penetrated the computer networks of three major American medical device manufacturers—Medtronic, Boston Scientific, and St. Jude Medical—according to a source close to the companies who spoke with the San Francisco Chronicle. The intrusions may have lasted as long as several months, though the exact duration and the precise objectives of the attackers were not made clear. Federal authorities, rather than the companies themselves, first detected the breaches and notified the affected firms, prompting each company to form internal task forces to investigate the incidents. The nature of the attacks was described as "very thorough," suggesting a high degree of planning and technical capability on the part of the intruders.

Signs pointed to China as the likely origin of the attacks, based on characteristics of the intrusion methods observed by investigators. This assessment aligned with broader concerns expressed by U.S. officials at the time, including President Obama, who raised the issue of Chinese cyber-espionage during a summit meeting with Chinese President Xi Jinping in California during the summer of 2013. High-technology companies, and particularly medical device manufacturers, were considered attractive targets because of the substantial intellectual property they possessed, including proprietary designs and clinical research data developed over decades. The attackers appeared to be seeking corporate secrets that could provide an edge in developing competing medical products, though federal breach disclosure laws meant that any confirmed compromise of patient information would have required public notification—a step none of the three companies took.

Upon notification, the medical device manufacturers declined to publicly confirm the specific details of the breaches. A spokeswoman for Medtronic stated that the company would not comment on any specific attack. St. Jude Medical did not respond to requests for comment. Boston Scientific, through Denise Kaigler, senior vice president of corporate affairs and communications, acknowledged that the company regularly experienced attempts to penetrate its networks and systems and that it maintained a dedicated team to detect and mitigate attacks and implement preventive solutions. However, Kaigler declined to discuss the particulars of any incident for security reasons and characterized the Chronicle's reporting as "inaccurate," without elaborating further. The FBI likewise declined to comment on the matter.

All three companies maintained significant operations in the San Francisco Bay Area, where much of their research and manufacturing activities were concentrated. Santa Rosa housed Medtronic's endovascular therapies and coronary businesses, while St. Jude Medical operated manufacturing plants in Sunnyvale. Boston Scientific had offices spread across San Jose, Santa Clara, and Fremont. Beyond their core manufacturing functions, these companies worked closely with doctors, hospitals, and medical researchers, and the clinical trial data collected through these partnerships sometimes contained personal patient information. The potential exposure of such data added a layer of concern beyond the loss of intellectual property, as compromised patient information could lead to identity theft, discrimination by employers or insurers, and other harms. Federal health privacy laws, while primarily directed at doctors and hospitals, can also extend to medical device makers that consult with physicians or assist in fitting and testing devices.

The broader economic and security context surrounding these intrusions was significant. A study by the Center for Strategic Studies and the security software maker McAfee estimated that cybercrime cost the United States economy roughly $100 billion annually. Experts noted that nearly every large company faced constant persistent threats and network reconnaissance from hackers scanning for vulnerabilities, and that inadequately prepared organizations could see decades of research and billions of dollars in intellectual property lost in moments. The medical sector, with its rich combination of proprietary technology and sensitive patient data, remained a particularly high-value target, and the 2013 intrusions at Medtronic, Boston Scientific, and St. Jude Medical exemplified the scale and sophistication of the threats facing American technology firms during that period.

Sources

Sources available to members: 2 sources.