Boston Scientific Cyberattack Leaves Hospitals Waiting on Implants

Boston Scientific is eight days into a global cyber outage that has halted device making and shipping. The Marlborough, Massachusetts, company still has no date for a full restore and has not said the incident is material.

That pairing should sound familiar. Stryker used the same public script after a March 11 attack, then needed 16 days to get most plants moving and 29 days to call itself whole.

Boston Scientific Is Running Stryker’s Playbook

Boston Scientific said it found the intrusion on August 25, 2026. The next day it told investors the incident had caused a global disruption to the company’s operations, including the systems it uses to process and ship customer orders. Shares fell about 4% that morning.

By August 29 the company had widened the damage list. Manufacture was down too, not only the shipping desk. Orders could still arrive by EDI and sit in a queue. They could not leave the dock.

The latest note, posted August 30 at 8:25 p.m. ET, named CrowdStrike among the outside firms on the job. Investigators had seen no fresh unauthorized activity since August 25, the company said, and the activity it did find was limited to certain on-premise systems, with cloud apps left alone. Confidence in a restart was rising. It was working toward partial restoration for some product shipments in the week that began August 31. Full capacity would wait until that restart could be shown to work.

As of September 2, that is still a target, not a confirmed resume. No group has claimed the attack. The company has not named a method, a stolen-data finding, or a date when plants run normally.

THE WEEK THE LINE STOPPED

1. August 25, 2026: Boston Scientific identifies a cybersecurity incident. The Cork day shift is sent home at 2 p.m. with full pay.
2. August 26, 2026: The company files a Form 8-K under Item 8.01 and says it cannot yet judge material impact.
3. August 28, 2026: Cork is told Friday shifts are not operating. Staff at Clonmel and Galway have already been told not to work some turns.
4. August 29, 2026: The company says manufacture, order processing, and shipping are all affected, and that new cardiac remote-monitoring set-ups are blocked.
5. August 30, 2026: CrowdStrike is named. The company says it is pushing for partial shipping of some products this week.

A freeze of this shape does its harm in the warehouse, not on a leak site. Hospitals do not need a ransom note to feel a missing stent or pacemaker. They need the carton.

The Filing Stops Short of a Material Call

The August 26 filing was not the form the SEC created for a cyber event already judged material. It was Item 8.01, Other Events. The company wrote that the full scope, including operational and financial effects, was not yet known. It had not determined whether the incident was reasonably likely to have a material impact.

While the Company is working diligently to restore affected functions and systems access, the timeline for a full restoration is not yet known.

Boston Scientific, Form 8-K, August 26, 2026

That sentence is almost stock language now. Stryker filed under Item 8.01 on March 11 with the same restoration line and the same refusal, on day one, to call the event material.

Erik Gerding, director of the SEC’s Division of Corporation Finance, told companies in a May 21, 2024 statement to put unfinished or non-material incidents somewhere other than Item 1.05. Item 1.05 is titled Material Cybersecurity Incidents. Using it for a live investigation, he wrote, risks confusing investors. Staff instead point firms toward voluntary cybersecurity notices under Item 8.01. If the company later decides the event is material, it then has four business days to file Item 1.05.

The 2023 cyber rules, adopted July 26, 2023, still require that materiality call without unreasonable delay. An 8.01 filing is not a finding that the outage is small. It is a finding that the company has not made the call yet.

Cork, Clonmel and Galway Went Quiet First

The first hard picture of the outage was not in Marlborough. It was on Irish factory floors. Boston Scientific employs more than 7,000 people at three plants in Cork, Clonmel, and Galway. The Cork site on Model Farm Road, open since 1997, employs about 1,200.

On August 25, staff were told of a global outage affecting network communications across the Ireland sites and other locations. The Cork day shift went home at 2 p.m. with full pay. Contract evening staff were later sent home on four hours’ pay. At Clonmel and Galway, some workers were told they would not be required and could take unpaid leave or annual leave.

Catherine Stoessel, senior vice president and chief information officer, emailed staff that people who could work from home should do so while the investigation continued, and that on-site shift needs would be decided case by case. Recovery, she said, would run in phases, with sites ranked by business need. By August 27, Cork was told all shifts due the next day, up to and including 6:30 p.m., were not operating.

A company can keep taking EDI orders and still have no one on the line to build the goods those orders describe. That is the gap the Ireland plants made visible. Boston Scientific has 13 manufacturing plants and about 59,000 employees, and it sells into 127 countries. When the on-prem systems that run those plants go dark, the sales network has nothing to move.

Why New Implants Lost Remote Monitoring

Devices already in patients are not the failure the company has described. The August 28 product note said there was no known impact to implantable cardiac rhythm management devices that were not on a Boston Scientific network, no known hit to clinicians using those devices, and no sign the outage had raised cyber risk to hospital networks through the hardware. Programmer interrogations still worked. Remote follow-up for devices that were already monitored before August 25 still worked.

The break is at the onboarding step for new implants. New communicators for pacemakers, defibrillators, and related CRM devices cannot be activated, so those new implants will not send data home until the communicator can be turned on. Newly placed insertable cardiac monitors cannot pair to the patient’s phone app. The monitor still records episodes. Getting those episodes out, for now, means an in-person interrogation with the Clinic Assistant app.

WHAT STILL WORKS, AND WHAT DOES NOT

• Implants in place: The company says it has found no known impact to the function of CRM devices already in patients.
• Old remote follow-up: Devices that were remotely monitored before August 25 can still send data, and programmers can still interrogate them.
• New communicator set-up: New remote-monitoring communicators for CRM implants other than insertable monitors cannot be activated.
• New monitor pairing: New insertable cardiac monitors cannot pair to the patient phone app until systems come back.

That is a narrower failure than a bricked pacemaker, and it is still a clinical one. A patient who received a device this week can leave the lab with hardware that works and a home monitor that does not. Clinics that live on remote alerts have to pull those people back in.

The same split shows up in hospital stock. Procedures that can run off devices already on the shelf are in a different place from hospitals waiting on implant shipments that never left a Boston Scientific dock.

Stryker Needed 29 Days to Call Itself Whole

Stryker’s March incident is the closest completed case. On March 11 it identified a cyber event that disrupted its Microsoft environment, then filed Item 8.01 the same day. It said it had no indication of ransomware or malware, believed the incident was contained, and had not yet determined material impact. The restoration sentence matches Boston Scientific’s almost word for word.

The factory reality did not match the calm of that first filing. Order processing, shipping, and manufacturing went down. Some patient-specific cases set for the week of March 16 were rescheduled because product did not arrive. Electronic ordering came back before every plant did. In Stryker’s March restoration customer updates, the company said it was ramping manufacturing around the clock and putting patient need first.

Most sites and critical lines were restored around March 27, 16 days after the hit. A later filing dated April 9, 29 days after, said the company was fully operational across its global manufacturing network, with commercial ordering and distribution restored. Stryker then said the attack had a material impact on first-quarter results and was not reasonably likely to change full-year guidance.

TWO OUTAGES, ONE SCRIPT

If that clock repeats, Boston Scientific’s “some products this week” note sits about where Stryker was when ordering flickered back and plants were still catching up. A mid-September full restore would land near Stryker’s 29-day mark. That is a comparison, not a promise. Stryker’s attack hit a Microsoft estate and was claimed in public. Boston Scientific has described an on-prem freeze and has named no actor.

Device Makers Have Spent the Year Recovering

Boston Scientific is a large target even in a quiet year. Investor materials put 2025 sales at $20.1 billion. The company’s 2025 annual report says its devices helped more than 48 million patients. It is a top maker of stents, catheters, pacemakers, defibrillators, and the Farapulse pulsed-field ablation system that has driven its electrophysiology boom. A week of missed shipments in that mix is not a routine IT ticket.

THE COMPANY AT THE MOMENT OF THE HIT

• 2025 sales: $20.1 billion, per the company’s investor page.
• Patients reached: More than 48 million lives improved, per the 2025 annual report.
• Reach: Products marketed in 127 countries, with about 59,000 employees and 13 manufacturing plants.
• Ireland footprint: More than 7,000 staff across Cork, Clonmel, and Galway.

It is also not the first large device maker to go dark this year. Stryker’s March outage shut ordering, shipping, and plants. Medtronic and Abbott disclosed their own incidents earlier in 2026. The pattern that keeps repeating is not a hacked implant firing in a patient’s chest. It is the corporate layer that prints the label, books the order, and clears the dock.

That is why the missing claim of responsibility is a poor comfort. Attackers who want a hospital to feel pain do not need a patient database if they can stop the firm that supplies the lab. A company that cannot be swapped overnight is already under pressure, with or without a leak site.

Partial Shipping Restarts Before Anyone Calls It Material

The August 30 update is the first crack in the freeze, and it is still a carefully hedged one. Some products, this week, if the restart can be shown to work. EDI stays open. The full timeline stays unknown. Item 8.01 stays on the file. CrowdStrike stays in the room. New heart monitors still cannot call home.

WHAT WE KNOW

• The window: The intrusion was found August 25, and the company says it has seen no unauthorized activity since that day.
• The systems: Unauthorized activity was limited to certain on-premise systems, with no impact to cloud apps, the company says.
• The operations: Manufacture, order processing, and shipping were all hit; EDI orders still queue.
• The devices: Existing CRM implants are described as unaffected in function; new remote-monitoring set-ups are not.

WHAT IS UNCONFIRMED

• The method: No public claim, and no company statement that this was ransomware, a wiper, or something else.
• The data: No finding yet on whether company, customer, or patient information left the network.
• The money: No Item 1.05 filing, and no figure for lost sales or extra costs.
• The restart: Partial shipping of some products was a goal for this week, not a posted confirmation as of September 2.

Stryker’s first 8-K also declined to call the event material. Twenty-nine days later the plants were back, and the first quarter still took a material hit. Boston Scientific is on day 8, with Irish lines already idled and a shipping restart only just in view. The next filing that matters is the one that either names a restore date or moves this incident from Item 8.01 to Item 1.05.