St. Jude Medical, Inc. STJ
St. Jude's $23B cardiac-device franchise rests on a Merlin ecosystem so insecure that hackers can crash pacemakers from 50 feet — a recall and two-year remediation imply 50%+ downside and likely covenant breach.
Thesis
Muddy Waters is short St. Jude Medical (STJ), arguing that 46% of the $23B company's revenue — pacemakers, ICDs and CRTs — is exposed to an imminent cybersecurity-driven recall. Working with cybersecurity firm MedSec, the firm demonstrates two catastrophic attacks on STJ's implantable cardiac devices: a 'crash' attack that forces dangerous pacing and a battery-drain attack, both executable within a 50-foot radius using the hundreds of thousands of $35 Merlin@home monitors STJ has distributed and which are readily sold on Ebay with unencrypted SSH keys. Muddy Waters argues remediation requires a full two-year RF protocol rewrite, triggering a sales moratorium, a likely 3Q16 bank-covenant breach, $6.4bn of product-liability exposure, and ratings downgrades. DCF sensitivity on network-shutdown and market-share-loss scenarios implies roughly 50-90% downside from $82 per share.
SCQA
St. Jude Medical is a $23B medical device company whose pacemakers, ICDs and CRTs — 46% of 2015 revenue — depend on a Merlin@home and Merlin.net ecosystem for RF-based remote patient monitoring.
MedSec found STJ's cardiac ecosystem is grossly negligent on security: hundreds of thousands of $35 Merlin@home units hold unencrypted SSH keys and can be weaponized to crash or battery-drain patients' implants from 50 feet.
STJ must recall the pacemakers, ICDs and CRTs, disable RF as a compensating control, and rewrite the RF communication protocol — a two-year remediation that imposes a product sales moratorium.
DCF sensitivity under network-shutdown and share-loss scenarios implies roughly 50-90% downside from $82; a likely 3Q16 covenant breach, $6.4bn litigation exposure and rating downgrades compound the decline.
The three reasons
- 1
STJ cardiac devices (46% of 2015 revenue) can be remotely crashed or battery-drained within a 50-foot radius
- 2
Hundreds of thousands of Merlin@home units ship with unencrypted SSH keys and are sold on Ebay for ~$35
- 3
A mandated recall and 2-year RF rewrite likely trigger a 3Q16 covenant breach and $6.4bn litigation exposure
Primary demands
- STJ should recall its pacemakers, ICDs and CRTs
- Immediately disable the RF capability of patients' implanted devices as a compensating control
- Rebuild the RF communication protocol and harden the Merlin ecosystem (estimated two-year remediation)
- Patients unplug their Merlin@home monitors until remediation is complete
KPIs cited
Pattern membership
Where this document fits across the library's 12 rhetorical / structural patterns.
Precedents cited
- Hospira Symbiq infusion pump recall (Billy Rios / FDA advisory 2015)
- Guidant pacemaker/defibrillator recall (J&J acquisition collapse, 2005)
- Boston Scientific defibrillator recall (2010, 13% overnight share drop)
- Thoratec HeartMate II LVAD blood-clot defect (2012-2015 market share loss)
Notable slides (6)
Notes
Filename '_2' suffix and page 2 note ('This version has been updated state that Dr. Nayak speaks for himself, and not his employer') indicate this is an updated version of the original 25-Aug-2016 Muddy Waters short report on STJ — not a later follow-up, hence classified as initial_thesis. Format is a long-form Word-style research note (34pp, Times Roman body, footnotes) rather than a designed pitch deck — classified research_note. Unusual collaboration: Muddy Waters licensed research from cybersecurity firm MedSec and paid it via fund profits; MedSec's medical advisor Dr. Hemal Nayak provides a signed patient letter in the appendix. Novel short thesis mechanism: product-safety/cybersecurity exposure driving forced recall, covenant breach and ratings downgrade rather than accounting fraud. Abbott was in the process of acquiring STJ at the time, which raises the MAC-clause parallel the report implicitly invokes via the Guidant/J&J case study. No stake disclosed — short position held by funds MW manages; disclaimer explicitly reserves right to change position.