Boston Scientific Cyberattack Leaves Hospitals Waiting on Devices

Boston Scientific said a cyberattack detected on August 25 cut off systems it uses to process and ship customer orders around the world. The Marlborough, Massachusetts, device maker has not set a date for full restoration, and it has not said whether hospitals or patients are affected.

The outage is already a supply problem for clinics that schedule stents, catheters, pacemakers and defibrillators against expected deliveries, not only an IT ticket inside a $20 billion company.

Boston Scientific Cannot Process or Ship Orders

The company filed an 8-K on the incident with the U.S. Securities and Exchange Commission on August 26, a day after it identified the intrusion. In that filing it said the event “has resulted in a global disruption to the Company’s operations,” then named the break that reaches outside the building: limits on systems “including the ability to process and ship customer orders.”

It posted a public update on the incident the same day, describing a network outage and saying third-party cybersecurity experts are helping to contain the threat. “While the Company is working diligently to restore affected functions and systems access, the timeline for a full restoration is not yet known,” the 8-K said. The company also said it has not yet determined whether the incident is reasonably likely to have a material impact.

THE FIRST 48 HOURS

1. August 25, 2026: Boston Scientific identifies a cybersecurity incident on certain information technology systems, producing a network outage and a global disruption to operations.
2. August 25, 2026: Local media in Ireland report thousands of staff at the Cork campus are sent home after network communications are cut across the company, TechCrunch reported, citing the Irish Examiner.
3. August 26, 2026: The company files the 8-K, tells customers and investors that order processing and shipping are impaired, and says the restoration clock is still blank.

No group had claimed a ransom or a data dump by August 27, and BleepingComputer said it could not find an extortion listing. The filing does not name the attacker, the entry method, or a confirmed theft of records. TechCrunch reported that public internet records show the company relies largely on Microsoft and Amazon Web Services for corporate infrastructure, the same class of stack Stryker lost in March.

Cath Labs Are Waiting on Devices They Cannot Reorder

Boston Scientific treats more than 48 million patients a year, according to its own 2025 figures, with 59,000 employees, commercial reach in 127 countries, and $20 billion in net sales. Those patients do not sit on the 8-K. Hospitals do, because implant stock is expensive, lot-tracked, and often thin on the shelf.

When asked by TechCrunch whether patients were affected, what they should do, or what kind of attack this was, spokesperson Chanel Hastings sent the public statement and would not answer. That silence leaves purchasing desks to assume the next purchase order will not move until someone says otherwise.

WHAT HOSPITALS ORDER FROM BOSTON SCIENTIFIC

• Heart implants: Pacemakers and defibrillators used in both scheduled implants and emergency care.
• Vessel hardware: Stents and catheters used in catheterization labs every working day.
• Scopes and tools: Endoscopes and other devices used in minimally invasive procedures.
• Nerve devices: Neuromodulation hardware that hospitals rarely overstock because of cost and expiry rules.

High-value implants do not sit in a hospital basement like gloves. Procedure lists are built around promised lots, and a maker that cannot confirm a ship date leaves those lists open. The outage looks like a break in order management and logistics, not a proven attack on the firmware inside a pacemaker already in someone’s chest. Clinics still have to plan as if the next box will not arrive.

A Class I Recall Hit the Same Week

On the same Wednesday the 8-K went out, the U.S. Food and Drug Administration updated a separate Boston Scientific action and classified it as a Class I recall, its most serious category. The products are the ENROUTE Transcarotid Neuroprotection System and ENROUTE NPS Plus, devices that may still sit in hospital inventory under Silk Road Medical names after Boston Scientific’s purchase of that line.

The company had already sent customers a July 9 letter telling them to stop use and distribution of listed lots after reports of arterial sheath tip separation during use. A retained tip can force a second procedure to fish it out, and the FDA lists embolism, stroke, transient ischemic attack, restenosis, or thrombosis among the complications. As of July 9 the firm had reported one serious injury and no deaths tied to the defect.

Hospitals are now told to return affected ENROUTE neuroprotection systems to Boston Scientific at the same moment the company’s order and ship applications are down. The recall did not cause the cyberattack, and the cyberattack did not cause the recall. They landed on the same receiving dock. Teams that pull recalled lots off the shelf cannot assume a clean replacement is in transit.

Stryker Lost Urgent Cases After a Similar Freeze

Medical-device makers had a quiet few years on this front, then 2026 turned into a list. Stryker’s March 11 attack, claimed by the Iran-linked group Handala, wiped more than 200,000 devices by abusing Microsoft Intune and shut ordering, shipping, and manufacturing for about three weeks. Medtronic later said a corporate IT breach left manufacturing and distribution intact. Abbott disclosed an attack on its cancer diagnostics business in July. Intuitive, iRhythm, AdaptHealth, Cook Medical, and West Pharmaceutical Services all reported incidents of their own.

Stryker is the closest match, because the break was logistics, not a press release about stolen files. Hospitals in the United States reported they could not order surgical supplies. Manufacturing came back in the week of April 1, and in July CEO Kevin Lobo said the company was still working through a backlog. RBC Capital Markets analyst Shagun Singh wrote that Stryker missed consensus organic sales by about $317 million in the first quarter. On the earnings call, Lobo said the company did not see a pause in orders.

We definitely had a pause in shipments, because we could not make product for almost three weeks, and so we were not able to ship the capital equipment that we normally would ship.

Kevin Lobo, Chair and CEO, Stryker Q1 2026 earnings call

He also told analysts that some urgent cases were lost when representatives could not get into hospitals, even though he did not see customers walk away. That is the hospital cost a three-week freeze already produced in this industry this year.

CISA already publishes healthcare sector mitigation guidance for this pattern, because a vendor outage moves from the IT desk to the procedure list faster in this industry than in most others. BlackFog’s 2025 ransomware tally, cited by CBS News, put healthcare at 22 percent of disclosed attacks. Comparitech counted 410 healthcare-sector ransomware events in the first half of 2026, with attacks on manufacturers up 36 percent from the prior half-year.

What the Company Still Has Not Said

Boston Scientific has not identified the attacker, the first stolen password or vulnerable server, or a date when orders will print again. It has not said whether plants can still make product while the order desk is dark, and it has not issued a note to implant patients. Those gaps are the live file, not a sideshow.

WHAT WE KNOW

• The date: The company identified the incident on August 25 and told the SEC on August 26 that it caused a global disruption, including a block on processing and shipping customer orders.
• The response: Incident-response plans were activated and outside cybersecurity specialists were brought in to investigate and contain the threat.
• The money line: The company says it has not yet determined whether the incident is reasonably likely to have a material impact.

WHAT IS UNCONFIRMED

• Ransomware: A spokesperson declined to say whether ransomware was involved, The Record reported, and no group had claimed the job by August 27.
• Data theft: The 8-K does not confirm that patient, employee, or company files were taken or published.
• The factory floor: The filing names order processing and shipping. It does not say whether manufacturing lines are running, idle, or working from paper.
• Hospital harm: Hastings would not say whether patients are affected or what they should do.

Until those four points are answered, a cath lab cannot treat the event as a back-office outage. The honest working assumption is that a replenishment order placed this week will not ship on the old clock.

Cork Staff Were Told to Stay Home

The first people to feel the network die were not analysts in New York. They were shift workers in Ireland, where Boston Scientific employs more than 7,000 people. About 1,200 work at the Model Farm Road plant in Cork, the Irish Examiner reported, a site opened in 1997.

On Wednesday, Catherine Stoessel, the company’s senior vice president and chief information officer, emailed staff that those who can work from home should do so, with on-site shift needs decided case by case. That is a plant being run around a dark network, not a headquarters memo about laptops. International sales were 36 percent of 2025 net sales, and about 60 percent of the 59,000 employees sit outside the United States, the company’s 2025 Form 10-K said. A global order freeze hits those sites first and the U.S. procedure list soon after.

Wall Street Models Three Weeks of Missed Shipments

Shares fell as much as 6 percent after the filing and were down about 4 percent in morning trade, Reuters said. Evercore ISI analyst Vijay Kumar told clients that Stryker’s incident took about three weeks to resolve, and that a similar clock at Boston Scientific could mean a 600 to 700 basis-point hit to third-quarter revenue. Piper Sandler’s Matt O’Brien, after speaking with management, wrote that the firm “may be able to return to shipping all of its products in less than three weeks,” and that sales will likely be hurt while the order desk is down.

THE NUMBERS INVESTORS ARE USING

• 2025 sales: $20 billion in net sales, up 19.9 percent as reported, with $12.86 billion of that in the United States.
• Stock move: As much as 6 percent off after the 8-K, about 4 percent down in morning trading according to Reuters.
• Analyst clock: Roughly three weeks, by the Stryker analog Evercore and Piper are both using.
• Q3 risk: 600 to 700 basis points of third-quarter revenue, in Kumar’s note, if that clock holds.

Those figures price a quarter. They do not price a postponed TAVR slot or a stent lot that is sitting in a warehouse the order system cannot release. Stryker still maintained full-year guidance after a $317 million-class miss and later said it had not really lost customers. Lobo still had to admit that some urgent cases never happened. Boston Scientific has not even started that conversation with the hospitals that buy from it.

As of August 27 the company had not named an attacker, a restoration date, or a guidance note for implant patients. Until an order can be entered and a carton can leave a dock, the people waiting are the ones on the procedure list, not the ones on the earnings call.

Disclaimer: This article is news reporting and analysis of a public company disclosure and related regulator notices. It is for information only and is not medical advice, investment advice, or legal advice. Readers who have a Boston Scientific device, a scheduled procedure, or a hospital supply decision should speak with their physician, their hospital’s materials team, or a licensed financial adviser before acting on anything described here. Figures, stock moves, recall statuses, and restoration claims reflect the sources available on August 27, 2026, and may change as the investigation continues.