Summary
- The 25 August cyber incident caused a global network disruption affecting manufacturing and order processing.
- Major distribution and manufacturing operations have resumed, while the company says the full recovery timeline remains uncertain.
- Boston Scientific no longer expects to meet its previous third-quarter and full-year 2026 sales and adjusted earnings guidance.
Boston Scientific expects the cyberattack that disrupted its global operations in August to have a material effect on third-quarter and full-year results, providing a clearer measure of the financial consequences of the incident.
The medical-device manufacturer identified unauthorised activity on 25 August. The incident caused a network outage affecting access to operating systems and business applications, disrupting manufacturing as well as the processing and shipment of customer orders.
Boston Scientific has now told investors that it is unlikely to meet the sales-growth and adjusted earnings ranges previously issued for both the third quarter and full 2026 financial year.
The disclosure advances the incident beyond the operational recovery picture reported earlier this week. Systems and facilities have been returning to service, but the company has now concluded that the disruption will still be material to its financial performance.
In an updated Form 8-K filed with the US Securities and Exchange Commission, Boston Scientific said major distribution centres were processing and shipping customer orders at or above normal operating levels. Sterilisation facilities were operational, and manufacturing had resumed across most facilities globally.
The company also said it had not identified continuing unauthorised access related to the incident. Its investigation remains ongoing, and it continues to restore affected systems.
Product-quality analysis has found no impairment to product function, according to a separate company update. A disruption affecting the activation of remote-monitoring functions for some cardiac devices has also been resolved.
Recovery of those services does not eliminate the accumulated business impact. Manufacturing interruptions can create backlogs that take longer to clear than the underlying systems take to restore, while delayed order processing can shift revenue between reporting periods or result in sales that cannot be recovered.
Boston Scientific previously expected full-year sales growth of between 5.5% and 6.5% and adjusted earnings of between $3.28 and $3.32 per share. It now expects to provide revised guidance when third-quarter results are published on 28 October.
The incident demonstrates the gap between technical recovery and operational recovery. Restoring network access is one milestone, but a manufacturer still has to recover production, sterilisation, distribution and customer fulfilment processes that depend on those systems.
That distinction is particularly significant in healthcare supply chains. Boston Scientific manufactures devices used in hospitals and clinical care, so interruptions can extend beyond the company’s own IT estate into availability and scheduling pressures for customers.
The regulatory disclosure also shows how cyber materiality can evolve. The initial incident established operational disruption, but companies often need additional time before they can quantify whether that disruption will alter financial guidance. Boston Scientific’s latest filing records that transition from an operational cyber event into a financial reporting issue.
The precise cost has not yet been disclosed. Boston Scientific has not quantified recovery expenditure, lost sales or the proportion of delayed orders that can ultimately be fulfilled. The company has also not publicly attributed the intrusion to a named threat actor.
What is established is that containment and substantial restoration have not prevented a material business impact. The incident affected production and fulfilment sufficiently that Boston Scientific no longer expects its previous financial outlook to hold.
