Almost half a million pacemakers have been recalled by the US Food and Drug Administration (FDA) due to fears that their lax cybersecurity could be hacked to run the batteries down or even alter the patient’s heartbeat.

The recall won’t see the pacemakers removed, which would be an invasive and dangerous medical procedure for the 465,000 people who have them implanted: instead, the manufacturer has issued a firmware update which will be applied by medical staff to patch the security holes.

Six types of pacemaker, all made by healthtech firm Abbott and sold under the St Jude Medical brand, are affected by the recall. They are all radio-controlled implantable cardiac pacemakers, typically fitted to patients with slow or irregular heartbeats, as well as those recovering from heart failure.

There have been no reports of unauthorised access to any patient’s implanted device, according to Abbot. The FDA says that the vulnerability allows an unauthorised user to access a device using commercially available equipment and reprogram it. The hackers could then deliberately run the battery flat, or conduct “administration of inappropriate pacing”. Both could, in the worst case, result in the death of an affected patient.

The US Department of Homeland Security said that “it is recommended that healthcare providers discuss this update with their patients and carefully consider the potential risk of a cybersecurity attack along with the risk of performing a firmware update”.

Robert Ford, the executive vice president of medical devices at Abbott, said: “All industries need to be constantly vigilant against unauthorised access. This isn’t a static process, which is why we’re working with others in the healthcare sector to ensure we’re proactively addressing common topics to further advance the security of devices and systems.”

It was the second round of updates for the heart implants that Abbott has announced since buying medical device maker St. Jude Medical earlier this year.

The weaknesses were discovered by MedSec, a cybersecurity firm that specialises in researching vulnerabilities in the medical devices and healthcare industries. It’s not the first weaknesses the company has found in St Jude Medical products, and it had previously been the target of a lawsuit from SJM for disclosing such vulnerabilities.

This is the second round of updates for the heart implants issued by Abbott since it acquired SJM in January this year.

MedSec hit headlines in 2016 for its unconventional approach to information security. On discovering flaws in St Jude Medical devices, it shared the information with an investment firm, Muddy Waters Capital, which then short-sold the stock, hoping to make money from the eventual financial hit the company would take when the issues were disclosed.

“We acknowledge that our departure from traditional cybersecurity practices will draw criticism, but we believe this is the only way to spur St Jude Medical into action,” the company’s chief executive, Justine Bone, said at the time.

In a statement, Abbott said “The risk of hacking is extremely low – in fact, the U.S. Department of Homeland Security said that compromising the security of these devices would require a highly complex set of circumstances. The FDA and Abbott recommend that patients talk to their doctors during their next regularly scheduled visit about the firmware update.”