FDA Recalls and Safety Communications for Insulin Pumps and Infusion Components: Patterns and Key Issues

Safety issues driving FDA recalls and safety communications for insulin pumps and infusion components

Insulin pumps and their disposable delivery components (infusion sets, reservoirs, cartridges, and pods) sit in a small set of FDA device classifications: infusion pump, insulin (product code LZG), insulin bolus pump (OPP), the alternate controller enabled ("ACE") insulin pump (QFG), and the automated insulin dosing device systems introduced with the interoperable/automated insulin delivery framework (OZO, OZP, OZQ, and the interoperable glycemic controller QJS) ^{115116117118120121122}. Because a single dosing error in these devices can move a patient directly toward hypoglycemia, severe hyperglycemia, or diabetic ketoacidosis (DKA), the recall record is dominated by delivery-integrity failures and skews toward the more serious classifications.

The shape of the recall record

Across the FDA device recall enforcement records for insulin pumps and infusion components, the great majority of actions are Class II corrections, with a persistent tail of Class I recalls tied to the most direct dosing hazards and a near-absence of Class III actions. The volume is not evenly distributed over time: it clusters around specific manufacturer events (large multi-model Medtronic MiniMed actions, infusion-set component recalls that span several pump platforms) and has accelerated again in 2024 to 2026 as software and connectivity defects in automated insulin delivery (AID) systems have surfaced ^{4213438163164}.

Distinct recall records by year and classification (deduplicated by recall/event number):

Counts are drawn from the FDA recall enforcement dataset and reflect distinct recall records; a single "event" often generates many recall numbers because each affected model or catalog number is enumerated separately (for example, the 2019 Medtronic MiniMed RF-vulnerability event alone produced more than a dozen recall numbers) ¹³⁴³⁸.

Failure-mode patterns

1. Mechanical and component defects in the pump body

The recurring mechanical failure is loss of a reliable seal or lock between the reservoir and the pump. Medtronic's largest such action was the November 2019 Class I recall of the MiniMed 600-series (620G, 630G, 640G, 670G), where a broken or missing retainer ring prevented the reservoir from locking properly, allowing over- or under-delivery and consequent hypoglycemia or hyperglycemia ¹⁴⁵. Earlier Animas pumps showed the same category of wear-driven hardware failure: keypad wear degrading the user interface, and force-sensor/calibration faults producing false loss-of-prime, occlusion, and "no cartridge detected" alarms ^136137141. Roche's Accu-Chek Spirit/Spirit Combo pumps were recalled for a faulty capacitor that could drop time-and-date settings during a power interruption (shifting the basal time blocks) and, separately, for rising mechanical E6/E10 errors that stop insulin delivery and can lead to severe hyperglycemia ¹³⁹¹⁴⁰.

2. Infusion sets, reservoirs, and cartridges: disconnection, leakage, and silent interruption

Disposable delivery components are a distinct and cross-cutting risk pool because the same set designs are sold across multiple pump brands. The dominant pattern is tubing or connector detachment that interrupts insulin delivery without triggering a pump alarm:

• Medtronic MiniMed Silhouette and Sure-T sets were recalled (2014) for tubing that could detach at the connect/disconnect point, interrupting delivery with no alarm and leading to hyperglycemia and DKA ¹⁴⁷.
• Unomedical Comfort/Contact Detach sets (2014) and Asante Comfort sets (2013) were recalled for the same detachment-and-leakage failure, delivering less insulin than intended ¹⁴⁸¹⁵¹.
• Roche Accu-Chek Tender sets (2014) were recalled for tubing detachment where delivery is interrupted and the pump does not alarm ¹⁴⁴.
• Unomedical VariSoft sets (October 2023, Class I) had manufacturing damage to the connector piece so it detached more easily than intended; an undetected overnight disconnection could cause missed basal dosing, nocturnal hyperglycemia, and DKA ¹⁵⁷.

A second component pattern is fluid-path integrity and over-delivery. Medtronic Paradigm sets (2013) could malfunction and deliver an incorrect volume if fluid contacted the interior of the set, and MiniMed Quick-set and Pro-set sets (2017) were recalled for a potential to over-deliver insulin ¹⁵⁰¹⁴⁶. Paradigm reservoirs (2013) were recalled for a leak risk that could both under-deliver and, if combined with a downstream blockage, prevent the pump from alarming ¹⁵⁶. Labeling errors on disposables also recur: the Unomedical Autosoft 90 recall (2022) corrected an IFU that misstated the cannula fill volume, causing an initial under-fill ¹⁵⁵.

3. Pod (patch-pump) defects: cannula deployment, cannula damage, and battery fire

Insulet's Omnipod platform shows a failure signature specific to the pod form factor. The earliest Class I actions (2015) were for cannulas that failed to deploy or retract, so the pod would not deliver insulin ¹²⁹¹⁷³. The 2026 Class I recalls shifted to cannula-integrity defects: an internal soft-cannula tear letting insulin leak into the pod (and potentially shorting the circuitry to shut the pump off), and external soft-cannula damage during manufacturing letting insulin leak around the pod, both causing under-delivery with escalation to DKA, hyperosmolar hyperglycemic state (HHS), or death across the Omnipod 5, DASH, and Eros pod lines ¹³⁰¹³¹. Distinct from the delivery path, the October 2022 Class I recall of the Omnipod DASH PDM concerned battery swelling, fluid leakage, and extreme overheating posing a fire hazard, including a complaint alleging a fire ¹⁷⁴.

4. Software, algorithm, and app defects: the growing category

The most active recent category is software, both the pump's embedded dosing algorithm and the companion smartphone app used in AID systems. Tandem accounts for a cluster of these:

• Control-IQ+ interpolation defect (February 2025, Class I) in Version 7.9 on the t:slim X2 and Mobi, mis-interpolating glucose trends when the estimated glucose value exceeded 255 mg/dL at the edges of a CGM data gap, causing over- or under-delivery and severe hypo- or hyperglycemia ¹⁶⁴.
• Unexpected autobolus (August 2025) on t:slim X2 and Mobi paired with the Dexcom G7, causing an unintended automatic correction bolus and hypoglycemia ¹⁶⁶.
• False vibration-motor failure / "Malfunction 12" (October 2025) on Tandem Mobi, stopping insulin delivery and active CGM sessions and causing hyperglycemia ¹⁶³.
• App-layer defects, including a right-to-left language pairing/graphics fault (July 2025) that could drive incorrect therapy decisions, and an inaccurate battery-life display among other issues in the 2022 t:slim X2 action, with hazards spanning hypoglycemia, hyperglycemia, and DKA ¹⁶⁵¹⁶⁷.

Medtronic's software-related actions include the 2022 recall where new or replacement pumps were not pre-programmed with basal rates and the labeling did not make clear the pump could run at a default 0.0 units/hr basal, risking under-delivery, severe hyperglycemia, and DKA ¹²⁷. Insulet's app-side defects include an Omnipod 5 iOS entry bug (September 2025) where the iPhone magnifier could duplicate a typed digit in a manual field, risking over-delivery and hypoglycemia, and a 2023 Omnipod 5 app error that blocked phone control and delayed therapy ¹³²¹⁷⁷.

5. Cybersecurity and wireless access

Connectivity has produced its own recall/safety-communication line. In 2019 Medtronic recalled a broad set of MiniMed Paradigm models (508, 511, 512, 515/715, 522/722, 523/723, Veo 554/754, and related "K"/"CM" variants) for a wireless RF communication vulnerability that could let an unauthorized nearby party connect to the pump and change settings or control insulin delivery ¹³⁴. A 2022 action addressed a MiniMed 600-series communication-protocol vulnerability allowing unauthorized access, with the mitigation being to disable the Remote Bolus feature ¹³³. Most recently, Beta Bionics recalled the iLet ACE pump / dosing decision software (2025) because the lock screen and limited-access passcode screen could be bypassed via active status-bar icons, allowing unauthorized access in Limited Access Mode ¹³⁵.

6. Battery and power interruption

Beyond the Omnipod PDM fire hazard above, Medtronic's July 2024 Class I recall (MiniMed 670G/770G/780G) addressed pumps that had been dropped, bumped, or impacted, damaging internal electrical components so battery life was reduced and the low-battery warning gave less lead time than intended, risking unexpected shutdown, interrupted delivery, under-delivery, hyperglycemia, and DKA ¹²⁸.

What the patterns show

Several themes run through the record:

• Under-delivery and DKA are the recurring worst case. Whether the proximate defect is a detached infusion set, a torn pod cannula, a mis-set basal default, an unexpected shutdown, or an algorithm error, the hazard statement most consistently escalates to hyperglycemia and DKA (and, in the newest pod actions, to HHS or death), which is what pushes many of these into Class I ^{147157128130131}.

• Silent failure is a repeated aggravator. Multiple infusion-set and reservoir recalls specifically note that delivery is interrupted without the pump alarming, removing the patient's ability to intervene, a factor the FDA records call out as elevating the risk ^147144156.

• Component recalls propagate across brands. Infusion sets and pods are manufactured by a few suppliers (notably Unomedical/Convatec) and sold under several pump ecosystems, so a single connector or cannula defect surfaces as recalls affecting Medtronic, Roche, Asante, and Tandem-adjacent products at once ^148151144157.

• The failure center of gravity has moved from hardware to software and connectivity. The early record is dominated by mechanical wear, reservoir/retainer, and tubing-detachment defects; the 2019-to-2026 record is increasingly software algorithm defects, companion-app bugs, and cybersecurity corrections, tracking the shift to AID systems, smartphone control, and interoperable (ACE pump / iCGM / iController) architectures ^{136147164166134135}.

• Manufacturing-variability defects in disposables remain live. The 2023 Unomedical connector damage and the 2026 Omnipod external-cannula damage are both framed as manufacturing defects rather than design defects, indicating process-control and incoming-inspection gaps on high-volume single-use components ¹⁵⁷¹³¹.

For a regulatory team, the actionable read is that delivery-integrity verification (reservoir/connector retention, cannula deployment and integrity), no-alarm/silent-interruption failure detection, AID algorithm and app change-control validation, and coordinated cybersecurity vulnerability handling are the areas where these products most often fail post-market and generate the most serious FDA actions.