Cyberattack halts Boston Scientific shipping and orders worldwide

Boston Scientific disclosed on Aug. 26 that a cyberattack had caused a global disruption to its operations, limiting access to IT systems and business applications and affecting its ability to process orders and ship products, according to a filing with the U.S. Securities and Exchange Commission.

The company makes cardiac devices, stents and other equipment used in hospitals around the world, so an extended outage risks delaying supplies for procedures. It is the second major medical technology maker hit this year, after a destructive attack on Stryker in March.

What happened

The company said the problems began on Aug. 25, the date it began containment. It reported disruptions and limitations of access to systems critical to its business and gave no timeline for restoration, TechCrunch reported. Irish media said thousands of staff at its campus in Cork were sent home after network communications were cut.

A spokesperson declined to say whether patients with Boston Scientific implants were affected, what kind of attack it was, or whether customer data was taken. No group has been publicly identified as responsible.

Recovery

Update: By Sept. 11, the company said it had fully restored manufacturing, order fulfilment and shipping, and that its distribution network was running at or above normal levels as it worked through backlogs, MedTech Dive reported. It said it was working with CrowdStrike and other outside experts and had found no evidence of threat activity or compromise of its systems or products since containment.

Chief executive Mike Mahoney told an investor conference that all plants and distribution centres had been shut down globally and that some procedures were lost because hospitals ran short of supplies. The company warned it would likely miss its third-quarter and full-year sales and earnings guidance.

What we don't know yet

Boston Scientific has not said how the attackers got in, whether data was stolen or whether a ransom was demanded. Public internet records indicate the company relies largely on Microsoft and Amazon Web Services for its infrastructure, but it has not said which systems were affected. It said it would give updated financial guidance at its Oct. 28 earnings call.