--- title: "Boston Scientific cybersecurity incident and order disruption" description: "Boston Scientific’s August 2026 cyber incident disrupted manufacturing, shipping and remote monitoring activations, with material financial impact expected." incident_type: "Cybersecurity incident" status: "active" last_modified: "2026-10-07" canonical_url: "https://www.ally.security/incidents/boston-scientific-manufacturing-outage" markdown_url: "https://www.ally.security/incidents/boston-scientific-manufacturing-outage.md" stix_url: "https://www.ally.security/incidents/boston-scientific-manufacturing-outage/stix.json" --- # Boston Scientific cybersecurity incident and order disruption A network outage disrupted manufacturing, order fulfillment and new cardiac-device remote monitoring activations. Company updates describe recovery, expected financial impact and the final investigation findings. Last modified Oct 7, 2026 · 6 sources ## Summary - **Environment:** Medical device manufacturing; on-premises IT infrastructure - **Operational impact:** Manufacturing, orders, shipping and new remote monitoring activations disrupted; phased recovery reported in September - **Financial impact:** Material Q3 and full-year 2026 impact expected; prior sales growth and adjusted EPS guidance unlikely to be met ## What happened [Boston Scientific](https://www.bostonscientific.com/) detected a cyber incident on August 25, 2026. Its [initial notice](https://news.bostonscientific.com/8-26-26-cyber-update-archive) reported a network outage affecting operating systems and business applications. The company disclosed the incident publicly and in an SEC filing on August 26. [2](#source-2) [6](#source-6) The outage disrupted product manufacturing, order processing and shipping. New cardiac-device remote monitoring activations were also affected. [5](#source-5) ## Impact - Manufacturing and order fulfillment were disrupted. Customers could submit electronic orders, but these were queued for later fulfillment. [5](#source-5) - New remote monitoring communicators could not be activated. Newly implanted insertable cardiac monitors could record episodes after clinic activation, but could not pair with the patient app for remote transmission; in-person interrogation remained available. [5](#source-5) - Boston Scientific reported no impact to implanted cardiac-device function or previously established remote monitoring and clinician access to that data. It also reported no evidence of increased cybersecurity risk to hospital networks using its devices. [4](#source-4) [5](#source-5) - In its [September 8 Form 8-K](https://www.sec.gov/Archives/edgar/data/885725/000088572526000059/bsx-20260907.htm), the company said material effects on Q3 and full-year 2026 results were likely and that it was unlikely to meet prior net sales growth and adjusted earnings-per-share guidance. It did not expect a material impact on its long-term financial condition. [2](#source-2) - The [September 22 investigation update](https://news.bostonscientific.com/update-on-recent-cybersecurity-incident) reported no evidence of compromise or data access, staging or exfiltration in the listed cloud, manufacturing-maintenance, development, device-maintenance, HR, benefits and SCADA systems, including customer or patient data in those systems. This finding has a defined scope. [1](#source-1) ## Timeline ### August 25, 2026 — Incident detected The company detected the incident and activated its response. [6](#source-6) ### August 26, 2026 — Order disruption disclosed The [initial update](https://news.bostonscientific.com/8-26-26-cyber-update-archive) and first SEC filing disclosed the incident. [2](#source-2) [6](#source-6) ### August 27, 2026 — Manufacturing and monitoring impacts described A [company update](https://news.bostonscientific.com/8-27-26-cyber-archive) detailed manufacturing disruption and problems activating new remote monitoring. [5](#source-5) ### September 3, 2026 — Shipping restoration begins The [shipping update](https://news.bostonscientific.com/9-3-26-cyber-update-archive) said restoration had begun for most products at major global distribution centers. Backlogs remained. [4](#source-4) ### September 5, 2026 — Broader operations resume The [archived recovery update](https://news.bostonscientific.com/9-8-26-cyber-update-archive) reported manufacturing had resumed at most facilities and all sterilization facilities were operating. [3](#source-3) ### September 8, 2026 — Monitoring restored; financial impact disclosed A [company update](https://news.bostonscientific.com/9-8-26-cyber-update-archive) confirmed remote monitoring activation was restored. The [SEC filing](https://www.sec.gov/Archives/edgar/data/885725/000088572526000059/bsx-20260907.htm) described expected material financial effects. [2](#source-2) [3](#source-3) ### September 22, 2026 — Investigation findings published The [final update](https://news.bostonscientific.com/update-on-recent-cybersecurity-incident) summarized CrowdStrike’s conclusions. [1](#source-1) ### October 7, 2026 — Briefing updated This briefing was last reviewed and updated on October 7, 2026. ## Threat Group & Attack Vector Boston Scientific said [CrowdStrike](https://www.crowdstrike.com/) traced access through an external-facing network device into a limited on-premises environment. The notice does not name an exploited vulnerability. [1](#source-1) ### Actors - No threat actor group is established in the retained notices. ### TTPs - No specific MITRE ATT\&CK technique is currently mapped for this case. ## Response The company activated incident response and engaged external investigators. The final update reported no evidence of continuing actor activity after August 25 containment. [1](#source-1) [6](#source-6) By September 5, major distribution centers were processing and shipping at or above normal levels, while teams continued reducing backlogs and restoring remaining manufacturing capabilities. Remote monitoring activation was restored by September 8. [3](#source-3) The September filing said the full recovery timeline and financial impact remained uncertain. Boston Scientific planned to update its 2026 outlook with its October 28 quarterly results call. [2](#source-2) ## Assets [Download the case-scoped STIX 2.1 bundle]() ## Sources Primary source records used to research this incident. ### Update on the August 25 cybersecurity incident official · Boston Scientific · Sep 22, 2026 ### Form 8-K: material cybersecurity impact and operational recovery official · Boston Scientific · Sep 8, 2026 ### September 8 cybersecurity update: remote monitoring restored official · Boston Scientific · Sep 8, 2026 ### September 3 cybersecurity update: shipping restoration official · Boston Scientific · Sep 3, 2026 ### August 27 cybersecurity update: manufacturing and device monitoring official · Boston Scientific · Aug 27, 2026 ### Archived update on cybersecurity incident official · Boston Scientific · Aug 26, 2026
Evidence ledger Review the supporting structured claims. 1. **Occurred At · 100% confidence · current** Manufacturing and remote monitoring disruption disclosed: 2026-08-27 2. **Disclosed At · 100% confidence · current** Boston Scientific cybersecurity incident and order disruption: 2026-08-26 3. **Occurred At · 100% confidence · current** Shipping restoration begins: 2026-09-03 4. **Resulted In · 100% confidence · current** Boston Scientific cybersecurity incident and order disruption: Boston Scientific said CrowdStrike found no evidence of compromise or data access, staging or exfiltration in the listed cloud, manufacturing-maintenance, development, device-maintenance, HR, benefits and SCADA systems, including customer or patient data in those systems. 5. **Resulted In · 100% confidence · current** Boston Scientific cybersecurity incident and order disruption: CrowdStrike found no evidence of continuing actor activity after containment on August 25, according to Boston Scientific. 6. **Resulted In · 100% confidence · current** Boston Scientific cybersecurity incident and order disruption: Boston Scientific confirmed its initial SEC Form 8-K disclosure was filed on August 26, 2026. 7. **Resulted In · 100% confidence · current** Boston Scientific cybersecurity incident and order disruption: Boston Scientific reported a network outage disrupting order processing and shipping. 8. **Resulted In · 100% confidence · current** Boston Scientific cybersecurity incident and order disruption: On September 3, Boston Scientific said it had begun restoring shipping for most products at major global distribution centers, while order backlogs remained. 9. **Resulted In · 100% confidence · current** Boston Scientific cybersecurity incident and order disruption: Boston Scientific did not expect a material impact on its long-term financial condition as of the September 8 filing. 10. **Resulted In · 100% confidence · current** Boston Scientific cybersecurity incident and order disruption: Boston Scientific reported no impact to implanted cardiac rhythm management device function or previously established remote monitoring and clinician access to that data. 11. **Resulted In · 100% confidence · current** Boston Scientific cybersecurity incident and order disruption: Boston Scientific reported that the outage affected product manufacturing as well as order processing and shipping. 12. **Resulted In · 100% confidence · current** Boston Scientific cybersecurity incident and order disruption: The September 22 update says CrowdStrike traced access through an external-facing network device into a limited on-premises IT environment. 13. **Resulted In · 100% confidence · current** Boston Scientific cybersecurity incident and order disruption: Boston Scientific reported no evidence that its affected network environment increased cybersecurity risk to hospital networks using its devices. 14. **Occurred At · 100% confidence · current** Monitoring restoration and financial impact disclosed: 2026-09-08 15. **Resulted In · 100% confidence · current** Boston Scientific cybersecurity incident and order disruption: On September 8, Boston Scientific said cardiac-device remote monitoring activation capability had been restored. 16. **Occurred At · 100% confidence · current** Broader operations recovery reported: 2026-09-05 17. **Resulted In · 100% confidence · current** Boston Scientific cybersecurity incident and order disruption: New cardiac-device remote monitoring activations were disrupted. Newly implanted insertable cardiac monitors could record episodes after Clinic Assistant activation but could not pair with the patient remote-monitoring app; in-person interrogation remained available. 18. **Resulted In · 100% confidence · current** Boston Scientific cybersecurity incident and order disruption: Electronic orders could still be submitted through EDI and queued for later fulfillment. 19. **Discovered At · 100% confidence · current** Boston Scientific cybersecurity incident and order disruption: 2026-08-25 20. **Occurred At · 100% confidence · current** Boston Scientific publishes final investigation summary: 2026-09-22 21. **Resulted In · 100% confidence · current** Boston Scientific cybersecurity incident and order disruption: The company planned to update its 2026 operational and financial outlook with its October 28 quarterly results call; the full recovery timeline and financial impact remained uncertain. 22. **Resulted In · 100% confidence · current** Boston Scientific cybersecurity incident and order disruption: Boston Scientific activated incident response and engaged external cybersecurity experts. 23. **Affected Organization · 100% confidence · current** Boston Scientific cybersecurity incident and order disruption: Boston Scientific Corporation 24. **Resulted In · 100% confidence · current** Boston Scientific cybersecurity incident and order disruption: Boston Scientific said the incident was likely to materially affect Q3 and full-year 2026 results and that it was unlikely to meet previously issued net sales growth and adjusted EPS guidance. 25. **Resulted In · 100% confidence · current** Boston Scientific cybersecurity incident and order disruption: By September 5, major distribution centers were processing and shipping at or above normal operating levels, all sterilization facilities were operating, and manufacturing had resumed at most global facilities.