Member-only story
‘Like Being Grilled Alive’: The Fear of Living With a Hackable Heart
A device connected to my heart could save my life. It could also be hacked.
Three nights before Christmas 2016, I was standing in my bathroom when a gallop broke out across my chest. It was ventricular tachycardia, a dangerous kind of arrhythmia where only one side of the heart pumps and does so at high speed, denying blood from moving through it. At the age of 23, I’d had arrhythmias all my life, but had never felt anything like this. Twenty minutes later, with the arrhythmia still going, I was in the back of a parked ambulance. Alone with the EMTs, I braced for the shock of a defibrillator.
The pain was overwhelming, like being grilled alive. It ran out from a center point in my chest and flowed into every organ, every limb, into my fingers and toes. Later, waiting in the trauma section of the Mount Sinai emergency room, doctors shocked me again.
Months of testing followed. I started taking drugs that would help reduce my arrhythmias, but in addition, my doctors suggested they replace my pacemaker with something called an ICD. The ICD would be a fail-safe, a tiny defibrillator inside my body that could go everywhere that I went.
When I came across an FDA safety notice warning that some ICDs, namely those made by a company called St. Jude, could be hacked, I was only days away from surgery. Once hacked, the devices could allow an external actor to gain control of the ICD, reprogram its functions, and inflict all kinds of damage—even trigger death.
The week before surgery, I texted my nurse practitioner about the FDA warning. She responded quickly, “Don’t worry. We’re using a different brand,” as if the issue was settled. In the blur of acute disease, I ignored the instinct to dig further into what exactly these cybersecurity concerns might mean or what other concerns might be hiding just below the surface.
When they first came to market in the 1980s, ICDs (implanted cardioverter-defibrillators) were implanted rarely, mostly in patients who had already experienced a life-threatening episode of ventricular tachycardia or even cardiac arrest. They were often called “secondary prevention” tools — meaning a patient has already…
