Incident Response Checklist for a Bluetooth Exploit in a Continuous Glucose Monitor App

A Bluetooth interruption can disrupt continuous glucose monitoring (CGM) readings or alerts, but a dropped connection alone does not prove an exploit occurred. Treat missing or unreliable readings as a safety issue first, then contact your care team and the device manufacturer to investigate.

What to do first to protect patient safety

If your readings or alerts disappear, do not rely on data you cannot verify. Use your backup blood glucose meter and follow your personal diabetes care plan. FDA materials advise using a meter when readings are unavailable or do not match your symptoms; follow the instructions for your particular CGM. FDA guidance on CGM and meter treatment decisions

• Check your glucose and act according to your care plan. Do not change insulin doses or device settings based only on missing or suspicious app data.
• Tell a caregiver if you rely on them to notice continuous glucose monitoring alerts.
• Contact your clinician promptly if the interruption affects treatment decisions, or if you use a connected insulin pump or automated dosing feature.
• Seek emergency medical help for a serious health emergency.

FDA warns that smartphone settings, hardware changes, and unsupported operating-system updates can interfere with diabetes-device alerts. FDA safety information about smartphone-compatible diabetes devices

How to maintain glucose monitoring during a Bluetooth interruption

Use the glucose-monitoring backup plan you developed with your healthcare provider. Keep a working meter, compatible test strips, and any other supplies your plan calls for available. Follow your meter’s instructions and your clinician’s guidance for checking glucose and responding to results.

Continue checking as often as your care plan requires while readings or alerts are unavailable. Record meter results and the time of each check so you can share a clear timeline with your care team. If you have symptoms that do not match a CGM reading, confirm your glucose with a meter and follow your care plan.

If your monitoring depends on an app-connected receiver or a connected insulin-delivery system, contact your clinician or the device manufacturer for instructions specific to your setup. Do not improvise changes to treatment settings to compensate for missing data.

How to contain a suspected CGM app compromise

Keep patient safety and evidence preservation in mind. Note when the problem began, what readings or alerts were affected, and any unusual pairing prompts, app messages, or device behavior. Save screenshots if you can do so safely, and record your phone model, app version, operating-system version, and CGM model.

Do not install an app from an unverified link, share pairing codes, or connect the sensor to an app the manufacturer has not authorized for your exact device. Avoid uninstalling the app, clearing its data, resetting the sensor, or deleting the pairing before contacting support; those steps may complicate troubleshooting or your current session.

Do not assume Bluetooth Low Energy encryption or authenticated Bluetooth pairing is present—or sufficient—on your particular system. Ask the manufacturer what security features apply to your model and what mitigation it recommends. FDA materials describe how Bluetooth Low Energy vulnerabilities can affect medical-device function and advise patients to seek help when a device may not be working as expected. FDA information about Bluetooth Low Energy vulnerabilities in medical devices

Check the manufacturer’s instructions for your supported mobile operating system and whether the app supports your phone’s current configuration. If the device instructions warn against using a rooted or jailbroken device, use a supported, unmodified phone or an approved receiver instead. Do not turn off Bluetooth or remove a sensor pairing without a safe monitoring alternative and guidance from your clinician or manufacturer.

How to restore secure Bluetooth pairing and app access

Use only the manufacturer’s official app or receiver and follow its model-specific pairing instructions. Confirm that Bluetooth is enabled, the phone is within the recommended range, and the app recognizes the correct sensor or transmitter. Do not accept unexpected pairing requests or share authentication codes.

Before pairing again, ask manufacturer support whether you should remove an old pairing, restart the phone, or reinstall the app. Pairing and recovery steps vary by system, so avoid repeated resets or unapproved workarounds. After access returns, verify that readings are updating and that the app’s alerts work as expected before relying on them.

How to troubleshoot lost readings and alerts

Start with basic checks that do not change treatment settings: confirm Bluetooth is on, the app is open or allowed to run in the background, and the sensor or transmitter is within the distance specified in its instructions. Check phone notification permissions, alert volume, and any Focus or Do Not Disturb settings.

Review recent phone updates or newly connected accessories, such as wireless headphones. FDA notes these changes can affect whether diabetes-device alerts are delivered or heard. Confirm that your phone’s operating system is supported before updating, and follow the manufacturer’s instructions for app and phone updates. FDA recommendations for checking diabetes-device alert settings

If readings or alerts remain unreliable, continue using your backup monitoring plan and contact the manufacturer’s technical support. Tell your clinician if the gap affects care decisions. Do not assume that a restored Bluetooth connection means the app’s alert function has also been restored; verify both.

When and how to report a suspected cybersecurity incident

Contact your healthcare provider and the CGM manufacturer if you have a suspected cybersecurity incident, especially if readings, alerts, or connected treatment functions were affected. Use the manufacturer’s official support or security contact, and share the device model and serial number through a secure channel. The FDA’s cybersecurity resources for patients and medical-device users recommend consulting device instructions, contacting the manufacturer, and speaking with a healthcare provider as needed.

For help reporting a medical-device cybersecurity vulnerability or incident, you can email the FDA’s Medical Device Cybersecurity Division at Cybermed@fda.hhs.gov. If the event involved a device malfunction, injury, or other product problem, patients and caregivers can also submit a voluntary report through the FDA’s MedWatch medical-device reporting program.

In your report, include the timeline, device and app versions, phone and operating-system details, symptoms or missed alerts, and troubleshooting steps already taken. A clear report can help the manufacturer’s cybersecurity response and the appropriate safety review. Keep following your backup monitoring plan until your clinician and the manufacturer confirm a safe way to resume normal use.

FAQs

What should I do if a Bluetooth exploit interrupts CGM readings or alerts?

Use your backup blood glucose meter and follow your diabetes care plan while readings or alerts are unavailable. Contact your healthcare provider and the CGM manufacturer, and seek emergency help for a serious health emergency. A lost connection alone does not confirm that an exploit occurred.

Should I uninstall and reinstall a suspected compromised CGM app?

Not as a first step. Record the problem and contact manufacturer support before uninstalling, clearing app data, or resetting the sensor. Follow the manufacturer’s instructions for your specific system.

Can I pair my sensor with an unapproved app?

No. Use only an app or receiver the manufacturer identifies as compatible with your exact CGM model. An unapproved app may not provide the validated readings, pairing, or alerts you expect.

Who should I contact to report a suspected CGM cybersecurity incident?

Contact your healthcare provider and the CGM manufacturer first, particularly if patient safety or device function may be affected. You can also email the FDA Medical Device Cybersecurity Division at Cybermed@fda.hhs.gov. For a device malfunction, injury, or other product problem, consider submitting a voluntary report through FDA MedWatch.