Boston Scientific Hit by Cyberattack, Can't Ship Orders, Stock Drops

Boston Scientific told the Securities and Exchange Commission on Wednesday, August 26, that a cyberattack detected the day before has caused a global disruption to its operations. The Marlborough, Massachusetts company makes pacemakers, stents, catheters, and neuromodulation devices used in hospitals worldwide.

The hack knocked out access to information systems and business applications the company relies on to run its supply chain, according to the SEC filing. That includes the ability to process and ship customer orders, the filing said.

"While the Company is working diligently to restore affected functions and systems access, the timeline for a full restoration is not yet known," Boston Scientific said in the filing.

Wall Street didn't wait for more details. Shares fell as much as 6% in early trading Wednesday, according to CBS News, and were down about 4.5% shortly after the opening bell, per CNBC. Geo News put the premarket drop at 5.8%. The stock had already lost close to half its value this year after Boston Scientific issued a weak profit forecast earlier in 2026, CNBC reported.

What the company doesn't know yet

Boston Scientific has not said who is behind the attack. No group has claimed responsibility and no ransom demand has been reported, according to The Next Web.

The company also hasn't determined whether the incident even rises to the level of a material event under SEC rules, the filing said, calling the full scope, nature, and financial impact still unknown. The Next Web flagged that as notable: most companies breached in 2026 have moved fast to declare "no material impact" within days of disclosure. Boston Scientific has not done that.

The filing is also silent on whether patient data was compromised, mentioning only the general risk of "unauthorized release of any confidential data or information" among its forward-looking risk disclosures, without confirming a breach of that kind occurred.

Boston Scientific said it activated its incident response protocols and brought in outside cybersecurity experts to investigate and contain the threat, the same standard playbook every breached company runs. That process alone doesn't tell you how bad this is.

The real-world disruption

This isn't just a data problem. Boston Scientific's products go into hospitals for scheduled procedures, and an inability to ship stents or pacemakers is a supply chain problem with profound real-world consequences.

Geo News reported that an internal memo obtained by the Irish Examiner showed the company telling more than 7,000 employees across its three Irish plants, in Galway, Clonmel, and Cork, that it was experiencing "a global outage affecting network communications across our Ireland sites and other locations worldwide." Boston Scientific reportedly sent Cork's day shift home with full pay while night shift workers waited on further instructions, according to the same report.

Boston Scientific employs roughly 59,000 people globally.

Wall Street's early read

Piper Sandler analyst Matt O'Brien told CNBC his firm spoke with Boston Scientific management Wednesday morning and believes the company could resume shipping all products in under three weeks. "The company is unable to process and ship orders, so sales will likely be adversely impacted," O'Brien wrote, adding this "is not great for a company that is already seeing sales growth slow."

That slowdown is real and predates the hack. Boston Scientific cut its full-year 2026 organic revenue growth guidance to 5-6% in late July, down from a prior forecast of 6.5-8%, according to Fierce Biotech. The company also announced a global restructuring program last month running through 2029 that it said would include some headcount reductions, though it hasn't specified numbers.

Part of a pattern, not an isolated hit

Boston Scientific joins a growing list of medical device makers targeted this year. Stryker was hit by a cyberattack in March that disabled cellphones and laptops for thousands of employees, with attackers claiming retaliation on behalf of Iran, according to Morningstar. Medtronic disclosed unauthorized access to some IT systems in April.

The healthcare sector was the single largest target for cybercriminals in 2025, accounting for 22% of all disclosed attacks, according to cybersecurity firm BlackFog's annual ransomware report, cited by CBS News. Separately, Check Point Research found organizations worldwide faced an average of 2,336 cyberattacks per week in July, up nearly 14% since May, Morningstar reported.

The four-business-day disclosure window comes from SEC cybersecurity rules adopted in 2023, which require registrants to report material incidents promptly rather than sit on them for weeks. Boston Scientific's filing arrived one day after it says it detected the intrusion.

What happens next depends on two things nobody outside the company can answer yet: how long the shipping outage actually lasts, and whether investigators find that patient data or connected medical devices were touched. Boston Scientific has given no timeline for either answer.