Every FDA Cybersecurity Recall, Analyzed (2008 to 2026)

In June 2026, CMR Surgical recalled one of its surgical robots. FDA's record gives the reason in one sentence:

The robot was designed with Secure Boot. One missed step on the production line turned that into a federal recall, posted in a public database where competitors, customers and FDA reviewers can all read it.

We wanted to know how often this happens and what manufacturers keep getting recalled for, so we read every cybersecurity recall FDA has on file. There are 53. The older ones are about vulnerable code and insecure radio links. Since 2023 they increasingly look like CMR's: security that existed in the design but not in the field, or a login that let the wrong person in.

That is good news for anyone building devices now. Of the 37 recalls where FDA describes the flaw, 30 fall into categories a standard medical device penetration test already covers. Below is what the recalls have in common, what to fix first, and a 10-point self-check you can run against your own device.

Cybersecurity recalls hit a record in 2025

FDA logged 25 cybersecurity recall events from 2008 through 2022, and 28 in the 46 months since. 2025 had 13, the most of any year. 2026 has 7 so far, and that number will climb because FDA posts a recall a median of 45 days after the company starts it.

The jump follows section 524B of the FD&C Act, which took effect on March 29, 2023, and FDA's final premarket cybersecurity guidance from September 2023, which FDA revised in June 2025 and again in February 2026. Recall records don't say why a problem came to light when it did, so we can't prove the rules caused the rise. They do show clearly that the kind of problem changed.

The flaws moved from code to access

Before 2023, most cybersecurity recalls traced to known vulnerabilities in common software, such as the Windows Remote Desktop and Print Spooler flaws and the Ripple20 TCP/IP stack, or to the wireless links of St. Jude Medical and Medtronic cardiac devices and insulin pumps, where FDA's records describe unauthorized wireless access, a vulnerable remote controller, or weak telemetry. Seven of those 25 recalls involved Class III devices, compared with two of the 28 since.

Then a new kind of recall started. Recalls where the main flaw is credentials or access control first appear in December 2023, and there have been ten since. Nine of the ten are hospital systems: imaging systems, a patient monitor, a cardiology data system, an anesthesia cabinet, drug library software and lab systems.

The credential recalls are the uncomfortable ones, because three of the five involved service or support accounts. BD recalled products twice, in October 2024 and September 2025, after "product service credentials used by some BD technical support teams to access certain BD products were accessed by an unauthorized actor." GE HealthCare had three: service login credentials that could be identified, an administrator credential that could be used from the local network, and user credentials left exposed on a client workstation. That last one is the subject of our earlier post, It Was Just Cached Credentials.

The numbers are small, and FDA doesn't describe the flaw in 10 of the 28 recent recalls, so some of the shift may come down to what gets written up. Going from none to ten in under three years is still a change worth planning for.

A cybersecurity recall can stay open for years

Four of the 53 events are Class I, FDA's most serious category, reserved for a reasonable probability of serious adverse health consequences or death. Three of the four came in 2025:

Baxter found its vulnerability through its own testing, and FDA still classified the recall Class I. Classification follows the risk to patients, whoever finds the problem.

Recalls also take a long time to close. FDA lists 36 of the 53 events as still open, and the 15 that closed took a median of 1,058 days, nearly three years. Medtronic MiniMed's 2019 recall, in which "an unauthorized person could potentially connect wirelessly to a nearby insulin pump to change settings and control insulin delivery," covers 16 products and is still open more than seven years later. A weakness in a wireless protocol often can't be patched in the field, so the fix is a replacement device.

How to stay out of the next update

These five recommendations come straight from the recalls above. If we were reviewing your device, this is the order we'd work in.

How we test for each pattern

Each flaw category FDA describes lines up with a specific kind of testing. This is how we'd cover each one on your device.

The one recall we left off, which FDA describes only as "Malware attack," doesn't say enough to map. The first six rows account for 30 of the 37 described flaws, and all six are standard parts of a medical device penetration test. Catching these before release is far cheaper than a recall that sits in FDA's public database for years.

Quick answers

The data

Methodology

The data comes from the openFDA device recall dataset, bulk export dated October 30, 2026 (59,646 product records), which mirrors FDA's Medical Device Recalls database. Recall classes (Class I, II, III) come from openFDA's enforcement report data. Two products aren't in the enforcement report yet, and for those we took the class from FDA's recall page.

We searched the reason for recall, root cause, action and product description of every record for security terms such as "cyber," "vulnerab," "unauthorized," "password," "credential," "malware," "secure boot" and "CVE-". That returned 201 candidate recall events. A second search with different terms ("antivirus," "firewall," "remote desktop," "security update" and others) found 16 more events, none of which qualified.

We reviewed every candidate by hand and included an event only if FDA's recall text describes a weakness that an unauthorized party or malicious software could use against the device or its data, or malware actually present on it. 144 candidates were false positives, matching on things like the company name Cyberonics, the CyberKnife system, "tamper-evident" packaging and "unauthorized distribution." We excluded four borderline events where FDA's text doesn't clearly describe a security weakness. Four included events list a security issue alongside unrelated problems, and the dataset marks them.

Each recall gets one flaw category for its main flaw. Two older recalls also mention access control and are counted elsewhere: a 2020 Medtronic recall for improper access control and cleartext transmission in its wireless telemetry (counted as wireless), and a 2017 Siemens recall that lists unauthorized data access through shared-folder permissions as one of five issues (counted as insecure configuration). We count recall events (FDA's event number), and the 53 events cover 158 product records. Years are by the date the firm initiated the recall. Flaw categories come only from FDA's wording, without filling gaps from news coverage or advisories.

We re-checked every event against the live openFDA API and its FDA recall page (event number, initiation date, firm, product count, recall text and recall class) and recomputed every total on this page from the dataset.

This analysis counts recalls, and many device vulnerabilities are fixed through advisories and updates without a recall, and a security-term search won't find a recall described only as a "software issue." Recent months are undercounted because of FDA's posting delay. We plan to update this analysis quarterly.