When the A.H. Robins Company pulled the Dalkon Shield from the U.S. market on June 28, 1974, the gap between what its inventor Dr. Hugh J. Davis had promised and what the device delivered was already measured in dead women: Davis had published a February 1970 study claiming a 1.1 percent pregnancy rate — comparable to the contraceptive pill and better than rival IUDs then quoting 2 to 3 percent — while concealing that he held a financial stake in the product, had followed roughly 640 patients for an average of only 5.5 months, told many of them to use backup contraception during the early cycles, and dropped non-compliant women from the count. Properly designed studies later put the real failure rate at 5 to 10 percent. By the time Robins acquired the device for $750,000 plus royalties in June 1970 and began mass-marketing it in January 1971, the wonder-IUD legend was built on a number its own inventor had manufactured.
The harm was not contraceptive failure alone. The Shield’s distinguishing feature — a multifilament Supramid removal string sheathed in nylon — acted as a wick, drawing bacteria from the vagina past the cervix into the sterile uterus. Women who conceived with the device in place frequently miscarried in the second trimester via septic abortion, an infected and sometimes fatal mid-pregnancy loss; survivors of pelvic inflammatory disease were often left with scarred fallopian tubes and permanent sterility. Roughly 4.5 million units were sold across 80 countries before withdrawal, about 2.5 million of them in the United States. At least seventeen American women died, and hundreds of thousands suffered PID, ectopic pregnancy, or infertility — a casualty pattern with no precedent in modern contraception.
Robins did not recall the devices already inside women’s bodies, and continued overseas distribution after halting U.S. sales. Litigation — not regulation — forced the truth into the open: discovery in cases tried before federal judges Miles W. Lord in Minnesota and later Robert R. Merhige Jr. in Virginia exposed internal memos showing the company had grounds to know of the wicking defect by 1971 and buried them. Facing a litigation tide it could not absorb, Robins filed for Chapter 11 bankruptcy in August 1985. Judge Merhige fixed its liability at $2.475 billion, funded by acquirer American Home Products into the Dalkon Shield Claimants Trust, which processed roughly 200,000 claims. The episode became the proximate political fuel for the 1976 Medical Device Amendments — the first U.S. law to require pre-market review of medical devices — making the Dalkon Shield the catastrophe that wrote the rulebook it had evaded.
When Medtronic Inc. suspended distribution of the Sprint Fidelis defibrillator lead on 15 October 2007, the gap between what the device promised and what it delivered was already measured in patients shocked awake by a machine guarding a heart that never faltered — and in others whose hearts stopped while a fractured wire stood silent. The Fidelis (models 6930, 6931, 6948, 6949) had been marketed since September 2004 as a refinement of an unglamorous component: the insulated wire that carries the sensing and high-voltage shock between an implantable cardioverter-defibrillator and the heart muscle. Its selling proposition was caliber. At 6.6 French — roughly 2.2 millimeters — it was the thinnest defibrillation lead on the market, slimmer than Medtronic’s own proven Sprint Quattro and easier to thread into the right ventricle. Thinner was sold as better. Thinner was the defect.
The harm took two mirror-image forms. When a Fidelis conductor fractured — and the thin, integrated cables fractured at higher-than-baseline rates near the can and the anchor sleeve — the lead generated electrical noise the ICD misread as a lethal arrhythmia, and the device did what it was built to do: it delivered a 30-to-40-joule shock into a fully conscious patient, sometimes dozens of times in a night. The opposite failure was worse. A fractured conductor could also break the circuit, so that when the patient genuinely arrested, the defibrillator could not deliver the therapy that was its entire reason to exist. Medtronic’s own analysis projected roughly 2.3 percent of leads fracturing within 30 months; independent center series ran far higher, near 3.75 percent per year against 0.6 percent for comparison leads. At least 13 deaths were ultimately linked to the lead.
Medtronic halted sales and recalled all unimplanted Fidelis leads; the FDA designated it Class I, its most serious category, reserved for products that may cause serious injury or death. But the defining feature was what did not happen: the roughly 268,000 leads already inside patients’ chests were largely left there. A defibrillator lead becomes encased in scar and bonded to the heart wall within months, and extraction can tear the vena cava or ventricle and kill the patient on the table. The recall could not undo itself. Patients were handed a probabilistic dilemma — leave a wire with a known, accelerating failure rate, or accept the lethal risk of pulling it — and a management tail that fell heavily on Medicare. A 2010 settlement of roughly 8,100 lawsuits for $268 million closed the litigation; it did not close the chests.
When Guidant Corporation issued its physician advisory on June 17, 2005 and the FDA classified it a Class I recall — the most serious category, reserved for defects with a reasonable probability of serious injury or death — the gap between the device’s promise and its performance had already been measured in a single funeral. The Ventak Prizm 2 DR (Model 1861) was an implantable cardioverter-defibrillator, a machine whose entire purpose is to deliver a life-saving shock at the instant a patient’s heart fibrillates. Guidant had known since February 2002 that a fraction of these units were prone to internal electrical arcing — a short-circuit across degraded insulation that could render the device inert exactly when it was called upon to fire. The company quietly re-engineered the device in November 2002 to fix the flaw, then told the FDA the change did not affect safety or effectiveness, and continued shipping the older, defect-prone inventory it had already built.
The concealed defect became a body on March 14, 2005, when Joshua Oukrop, a 21-year-old college student from Grand Rapids, Minnesota, with hypertrophic cardiomyopathy, collapsed and died on a mountain-biking trip in Utah. His implanted Prizm 2 DR had short-circuited and failed to shock him. His electrophysiologists, Dr. Robert Hauser and Dr. Barry Maron of the Minneapolis Heart Institute, asked Guidant what had happened; the company disclosed that it knew of the failure mode but had no plan to warn physicians. Hauser and Maron took the case to The New York Times, whose reporter Barry Meier published it on May 24, 2005. Public exposure, not the manufacturer’s conscience, forced the recall three days later.
The reckoning was not regulatory but criminal. After a four-year investigation, the U.S. Department of Justice charged Guidant — by then a subsidiary of Boston Scientific, which had acquired it for roughly $27 billion in April 2006 — with making a materially false statement to the FDA about the Prizm 2 DR and failing to report a “correction” to its Contak Renewal defibrillators. Guidant pleaded guilty, and on January 12, 2011 U.S. District Judge Donovan W. Frank in St. Paul ordered it to pay more than $296 million in fines and forfeiture and serve three years of supervised probation — at the time the largest criminal penalty ever imposed for violating the Food, Drug, and Cosmetic Act. The episode became the foundational case for the principle that withholding a known device defect from regulators is not a paperwork lapse but a prosecutable crime.
When St. Jude Medical stopped selling its Riata and Riata ST defibrillator leads in December 2010 — eleven months before the FDA would classify the action as a Class I recall on 28 November 2011 — the gap between the device’s premise and its behavior was already a matter of cardiac geometry: a lead engineered to carry high-voltage shocks reliably for the life of an implantable cardioverter-defibrillator (ICD) was instead destroying itself from the inside out. The silicone insulation that sheathed the inner cabling abraded against the conductors it was meant to protect, and the high-voltage wires worked their way through the insulation and externalized — poked out of the lead body — inside the patient’s veins and heart. By the time sales stopped, more than 227,000 Riata-family leads had been distributed worldwide, roughly 79,000 of them still implanted in living U.S. patients, each one a wire that could fail to deliver a defibrillation shock at the one moment it was needed.
The danger of the Riata defect was not that it failed loudly but that it failed silently and electrically. A lead with externalized conductors could pass a routine pacing check on a clinic telemetry interrogation and still be incapable of completing a defibrillation circuit when a patient’s heart fibrillated. The mechanism was an electrical short between the superior-vena-cava and right-ventricular shock coils — the kind of fault that does not announce itself until the device must actually defibrillate, and then does not. Imaging studies later found externalized conductors in roughly 19 to 27 percent of Riata leads examined, with the thicker 8 French models worse than the 7 French Riata ST, and meta-analysis tied externalization to a more than six-fold rise in electrical abnormality.
The Riata story is less a tale of a single catastrophic flaw than of how long a known reliability problem can travel before regulation catches it. The leads had been on the market since 2001–2002; St. Jude withdrew them commercially in December 2010 in favor of its newer Durata lead, which carried an Optim co-polymer coating the company argued would resist abrasion. Only in late 2011 — after a Minneapolis Heart Institute cardiologist, Dr. Robert Hauser, mined the FDA’s MAUDE adverse-event database and published a series linking the Riata family to roughly 22 deaths from high-voltage shorting — did St. Jude issue the formal physician advisory the FDA then classified as Class I. St. Jude disputed Hauser’s death count and demanded a retraction; the underlying signal stood. As with Medtronic’s earlier Sprint Fidelis leads, the medical response was overwhelmingly to monitor in place rather than extract, because pulling a scarred-in lead from the heart carries its own mortal risk: at least two of the deaths in the recall record came not from the defect but from the extraction.
When Telectronics Pacing Systems issued a voluntary worldwide recall of its Accufix atrial “J” pacemaker leads on November 3, 1994 — a recall the U.S. Food and Drug Administration classified as Class I, its most severe category, reserved for products with a reasonable probability of causing serious injury or death — the device had already been doing precisely that. The Accufix lead carried, just behind its J-shaped tip, a thin metal “retention wire” whose only job was to hold the curve that anchored the electrode in the right atrial appendage. That wire fractured from metal fatigue, and the broken end could protrude through the lead’s polyurethane insulation and lacerate the atrial wall, the great vessels, even the aorta. The feature engineered to keep the lead in place became the mechanism that perforated the heart.
The gap between the design intent and the delivered harm was unusually stark because the failure was not rare. Radiographic screening of recalled-population patients found definite retention-wire fracture in 22.4 percent of leads examined, with the incidence climbing toward 25.6 percent on re-evaluation; the multicenter study put the fracture risk at roughly 5.6 percent per year. Roughly 45,000 leads had been implanted worldwide — about 25,000 of them in U.S. patients — across models 330-801 and 329-701. By the time of recall, Telectronics had logged two deaths and two non-fatal injuries; the worldwide registry would eventually record 40 spontaneous injuries, including 19 pericardial tamponades and six deaths.
What made the Accufix case distinct from a simple defective-device story was the trap it set after withdrawal. The lead could not simply be swapped like a battery: it was screwed into beating cardiac tissue and scarred in by years of healing. Extraction was itself lethal — fatal complications occurred in 0.4 percent of intravascular extraction procedures, 16 deaths among 4,023 attempts. Patients and cardiologists faced a documented dilemma with death on both arms: leave a fracturing wire in the heart and accept an annual protrusion risk, or pull it and accept an extraction-mortality risk that, for many low-fracture-risk patients, exceeded the hazard of leaving it alone. Telectronics funded the Accufix Research Institute to run the registry and study that quantified that trade-off, then exited the pacing business; the U.S. litigation consolidated as MDL-1057 and resolved in a settlement establishing a $58 million medical-monitoring and claims fund.
When Allergan announced a voluntary worldwide recall of its BIOCELL textured breast implants and tissue expanders on July 24, 2019 — at the request of the U.S. Food and Drug Administration — the gap between the product’s marketing and its documented harm was already a measurable oncologic toll: the FDA cited 573 unique cases of breast implant-associated anaplastic large cell lymphoma (BIA-ALCL) worldwide, of which 481 were attributable to Allergan devices, and 33 patient deaths, with 12 of the 13 deaths for which the implant maker was known confirmed to involve an Allergan implant. The agency’s analysis put the BIA-ALCL risk of BIOCELL macrotextured shells at roughly six times that of textured implants from other manufacturers then on the U.S. market. The implant had been sold as an ordinary reconstructive and cosmetic option; what it delivered, in a small but non-trivial fraction of recipients, was a lymphoma growing in the scar capsule around the device.
The harm was not a manufacturing defect in the conventional sense — it was the shell’s defining feature. BIOCELL was a macrotextured surface produced by a “salt-loss” process that pressed salt crystals into the silicone and dissolved them away, leaving a deeply pitted, high-surface-area shell originally marketed to anchor the implant and reduce capsular contracture. That same surface area is now the leading mechanistic suspect: it harbored more bacteria, sustained chronic biofilm and immune stimulation against the textured surface, and over years of low-grade inflammation appears to have driven T-cell transformation into ALCL in the periprosthetic capsule. The disease typically presented as a delayed seroma or mass years after implantation; caught early and treated by complete capsulectomy it was often curable, but advanced cases were lethal.
Regulators abroad moved first. France’s medicines agency, the ANSM, declined to renew the CE mark for Allergan’s macrotextured implants in December 2018 and in April 2019 became the first national regulator to ban macrotextured and polyurethane breast implants outright as a precaution. The FDA, which had publicly flagged a possible breast-implant/ALCL association as early as January 2011, did not force Allergan’s hand until July 2019 — by which point hundreds of thousands of the shells were already in patients’ bodies and would remain there, since neither the FDA nor Allergan recommended removing implants from asymptomatic women. As cumulative reporting matured, the case count climbed: by 2023 the FDA had documented on the order of 1,264 BIA-ALCL cases globally and 63 deaths, with roughly 85 percent of cases tied to Allergan textured devices. The BIOCELL recall became the modern textbook case of a device hazard that was rare, latent, and surface-intrinsic — and of a regulatory system that recognized the signal years before it acted on it.
When Johnson & Johnson’s Ethicon division suspended global sales of its Gynecare power morcellators in April 2014 and recalled them outright that July, the gap between the device’s promise and its harm was already written into the abdomen of the woman who had forced the action: Dr. Amy Reed, a 40-year-old Boston anesthesiologist and mother of six, had undergone a laparoscopic hysterectomy at Brigham and Women’s Hospital in October 2013 to remove presumed-benign fibroids. The morcellator — a powered tube with a rotating blade that minces tissue for extraction through keyhole incisions — shredded an undiagnosed uterine leiomyosarcoma and sprayed malignant fragments across her peritoneal cavity, advancing a contained cancer to Stage IV. The tool marketed as the enabler of fast, scarless gynecology had, in her case, converted a survivable tumor into a terminal one.
The mechanism was inherent, not incidental. No reliable preoperative test distinguishes a benign fibroid from an occult uterine sarcoma; both present as a uterine mass, and the blade cannot tell them apart. When the FDA ran the numbers in April 2014, it estimated that roughly 1 in 350 women undergoing hysterectomy or myomectomy for presumed fibroids in fact harbored an unsuspected sarcoma, and that morcellating such a tumor risked peritoneal dissemination and upstaging to FIGO Stage III or IV in approximately 25 to 65 percent of cases — sharply cutting long-term survival. The device had been in routine American use since 1993, cleared through the FDA’s 510(k) pathway as “substantially equivalent” to predicate devices, never required to show it would not seed cancer.
The reckoning came not from regulators or manufacturers but from a patient and her husband. Reed and Dr. Hooman Noorchashm, a cardiothoracic surgeon, filed her adverse-event report in December 2013 and launched a relentless public campaign. A 2017 Government Accountability Office review (GAO-17-231) found that across the device’s first two decades the FDA had received essentially no adverse-event reports linking morcellators to cancer spread — a real, recurring harm invisible to a passive surveillance system dependent on clinicians voluntarily reporting it. The FDA issued its first safety communication on April 17, 2014, J&J withdrew its market-leading devices, and on November 24, 2014, the agency mandated a boxed warning. Amy Reed died on May 24, 2017, at 44.
When C.R. Bard stopped selling its Recovery inferior vena cava filter in 2005, it did not recall the device or warn the roughly 34,000 patients carrying one inside the largest vein in the body; it replaced the Recovery with a cosmetically modified successor, the G2, and the gap between the promise and the harm was by then already documented in Bard’s own files. The Recovery was marketed as the first retrievable IVC filter cleared in the United States — a spider-shaped nitinol cage meant to catch blood clots traveling toward the heart and lungs and then, unlike permanent filters, to be removed once the danger passed. A confidential study Bard commissioned in 2004 found the opposite of a safe device: the Recovery carried higher relative risk of death, filter fracture, and migration than every competing filter on the market.
The failure mechanism was mechanical and lethal. The Recovery’s thin struts fractured, and the broken fragments — sharp lengths of nitinol — embolized through the bloodstream into the right heart and the pulmonary arteries, or the whole filter migrated and perforated the vena cava wall. A December 2005 internal Bard document, later obtained by NBC News, recorded that the Recovery had an “11.5 times higher reporting rate for filter embolization deaths” than all other vena cava filters combined. Bard had recruited a veteran regulatory specialist, Kay Fuller, to shepherd the FDA clearance; Fuller refused to sign the application over safety concerns, and the application reached the FDA bearing what she says is a forged version of her signature.
Rather than recall the Recovery after the 2004 report urged urgent investigation, Bard withdrew it from sale in 2005 and sold the G2 — a device Bard’s own records show it knew was fracturing and migrating within four months of clearance. The death toll surfaced not through a regulator but through a year-long NBC News investigation broadcast in September 2015, which linked the Recovery to at least 27 deaths and more than 300 non-fatal injuries. Thousands of suits consolidated into a multidistrict litigation in Arizona, and the first bellwether — Sherr-Una Booker, whose G2 fractured and required open-heart surgery — produced a $3.6 million verdict in March 2018, including $2 million in punitive damages. The FDA never recalled the Recovery; the legend of the “retrievable” filter ended as a case study in replacing a known-defective implant instead of retrieving it.
When Atomic Energy of Canada Limited (AECL) shipped the Therac-25 medical linear accelerator at the start of the 1980s, it marketed a machine whose safety the manufacturer had quietly relocated from steel to software — and the gap between that promise and the harm was eventually measured in carbonized tissue and dead patients. Earlier models, the Therac-6 and Therac-20, had retained electromechanical interlocks: physical hardware that mechanically blocked the high-power photon beam unless the beam-spreading and flattening apparatus was correctly in place. The Therac-25 deleted those interlocks to cut cost and add flexibility, trusting reused, single-author, unreviewed control code to keep the two beam modes — low-current electron and ~100x-stronger raw photon — from being confused. They were confused. Between June 1985 and January 1987, six patients received massive overdoses; at least three died.
The lethal mechanism was a race condition, not a melodrama. If an operator at the VT-100 terminal entered the prescription, then within roughly eight seconds used the cursor to edit the beam mode from X-ray to electron and pressed Enter, a fast typist could outrun the software’s set-up routine. The machine’s internal state and its physical hardware fell out of sync: the console believed it was delivering a safe electron dose while the accelerator fired an unattenuated photon beam with no spreader in place — a needle of radiation on the order of 15,000 to 25,000 rad against a prescription of roughly 200. A second, independent defect — a one-byte counter that overflowed to zero exactly when an operator hit a particular timing — could disable a safety check entirely. Both bugs were dormant most of the time, which is precisely why they were so dangerous.
For nineteen months AECL insisted the machine could not overdose. After the first injuries the company told hospitals the Therac-25 was incapable of the harm being reported, and could not reproduce the fault in its own facility because its engineers did not type the way an experienced therapist did. The reckoning came not from AECL but from a Tyler, Texas medical physicist, Fritz Hager, who painstakingly reproduced the malfunction, and from the U.S. Food and Drug Administration, which on May 2, 1986 declared the Therac-25 defective under the Radiation Control for Health and Safety Act and required corrective action plans before the machines could resume routine use. The case became — through Nancy Leveson and Clark Turner’s 1993 IEEE Computer investigation — the founding text of software-safety engineering: the canonical proof that a computer can be a murder weapon when its makers treat code as inherently safer than the hardware it replaced.