Boston Scientific confirms "cyber incident" knocks systems offline, disrupting shipments worldwide

Boston Scientific on Wednesday confirmed a “cybersecurity incident” knocked some of its technology systems offline, disrupting operations and impacting the medical device maker’s ability to process and ship customer orders.

The Massachusetts-based company announced the breach in a notice posted on its website – also submitting an 8-K regulatory filing with the U.S. Securities and Exchange Commission (SEC).

The global medical technology behemoth says it first detected an intrusion on Monday, August 25th, triggering a network outage that affected several IT operating systems and business applications.

“Once detected, the company activated incident response protocols and began an investigation to assess and contain the threat with the assistance of third-party cybersecurity experts,”

Boston Scientific said in a statement.

The company has not disclosed how the attackers accessed the network, whether ransomware was involved, or whether any company, employee, or customer data was stolen, but says the investigation is ongoing.

The medical device manufacturer also says that while it is “working diligently” to fully restore systems, it cannot provide a specific timeline for when operations will return to normal.

Medical device shipments disrupted

Providing life-saving medical devices for hospitals and clinics worldwide, Boston Scientific develops and manufactures a range of specialty devices that treat more than 48 million patients each year.

This includes well-known devices used in cardiac surgeries such as pacemakers, stents, and the widely used WATCHMAN clot blocker implant.

This means a disruption to its order-processing and shipping could have devastating effects on patient care, potentially leading to fatalities if there is a major delay in getting systems back up and running in a timely manner.

Ross Filipek, CISO at Corsica Technologies, says the main priority for Boston Scientific is “containing the attack without letting recovery create another problem,” noting that the disrupted systems include the applications needed to process and ship customer orders.

"Security teams need constant visibility into what was affected and which systems are safe to bring back online," he says.

Boston Scientific supplies devices used in cardiac care, endoscopy, and urology. Hospitals depend on that flow of equipment to keep procedures moving. Delays can ripple into scheduling and patient care,

says Ross Filipek, CISO at Corsica Technologies.

Still, the CISO warns of major concerns extending beyond “just another corporate IT outage.”

For healthcare organizations, even attacks that don't directly compromise clinical systems can trigger a cascade of problems, including logistics, scheduling, inventory, billing, and other critical business operations.

Filipek also noted that medical device companies in general have had a rough year, citing recent cyberattacks on US device makers Stryker, Medtronic, and Abbott Laboratories.

“In healthcare, downtime carries operational consequences quickly. Strong incident response has to protect the environment while helping the business restore critical services as safely and efficiently as possible," Filipek says.