- St. Jude Medical filed suit against Muddy Waters Capital and cybersecurity firm MedSec for publicly alleging that its cardiac devices are vulnerable to cyberattacks and selling short the company's stocks.
- The device maker had already retorted that the allegations were false and misleading, and sought to refute the finding by arguing that the supposed vulnerability discovered was actually a security feature rather than a flaw and that it was working as intended.
- St. Jude Medical's lawsuit now accuses the companies of conspiring to manipulate the market, and argues that they were irresponsible in publicly releasing their allegations in a way that frightened patients and providers, and circumvented "appropriate and established channels" for raising concerns about cybersecurity.
The public move by Muddy Waters and MedSec had been viewed as one possible strategy, which could potentially spread, for pressuring healthcare companies into bolstering their cybersecurity. The pair said they took the route of bypassing St. Jude in favor of a public warning, short-sell and call for device recalls because they deemed St. Jude to have a history of not responding to security concerns.
St. Jude's lawsuit aims to prevent the use of that strategy, arguing it to be "critical to the entire medical device ecosystem."
The case raises debate about how and when critics should be heard, and how to weigh regard for patients dependent upon the technology in question.
“We recognize that the cybersecurity landscape is dynamic, which is why we partner with researchers, agencies, consultants and others to continually strengthen our security measures currently in place,” Phil Ebeling, vice president and chief technology officer at St. Jude Medical, said in a statement. “We also have processes in place to encourage anyone with information about the security of our technology to share it with us so that we can enhance our technology for the benefit of patients.”
The issue is swirling as St. Jude looks toward its pending acquisition by Abbott Laboratories. Following regulatory approval, that deal is expected to close in the fourth quarter. The $25 billion deal inked in April valued each St. Jude Medical share at about $85, though that value was jeopardized when the company saw its shares drop more than 8% upon release of the Muddy Waters report in August.