Boston Scientific identified a cybersecurity incident on 25 August 2026 and filed a Form 8-K on 26 August. A second 8-K, with an event date of 7 September and signed 8 September, gave an update under Item 1.05, the SEC item for material cybersecurity incidents. The text below comes from that second filing.
What the filing says
- Unauthorized activity on "certain of the Company's systems" caused a network outage.
- The outage cut access to some operating systems and business applications and disrupted manufacturing, order processing and shipping worldwide.
- Restoration is "well underway." Major distribution centers are shipping at or near normal levels, sterilization facilities are running and manufacturing has resumed at most sites.
- The company says the timeline for full operational recovery is uncertain.
- It has found no evidence of ongoing unauthorized access, but the investigation remains open.
- It expects the incident to materially affect third quarter and full year 2026 results and says it is unlikely to meet the sales growth and adjusted EPS guidance it gave on 29 July 2026.
- A revised outlook is expected on the third quarter earnings call, scheduled for 28 October 2026.
What is confirmed, reported and unknown
- Confirmed by the filing: the discovery date, the outage, the operational disruption, the financial statement and the call date.
- Reported by third parties: we did not rely on any.
- Unknown: the type of attack, the initial access method, whether data was taken, who is responsible, and the size of the revenue loss. The filing names no actor and does not say whether ransomware was involved.
Do not fill those gaps with guesses. A filing that is silent on a point is not confirming it.
What to do now
- Read the filing as a template. Ask whether your finance and legal teams could produce the same disclosure within four business days of a materiality decision.
- Map which of your plants, warehouses or sterile processes depend on one network or one ERP.
- Define a minimum viable shipping process that runs without the main business systems, even by hand.
- Check that your cyber insurance and customer contracts match your real recovery time.
- Test restoration of your order and inventory systems, not just file backups.
How this could have been avoided
The filing gives no entry point, so we cannot name the missing control. What it does show is where the damage landed: manufacturing, orders and shipping all sat behind connected systems.
- Segmentation between corporate IT and plant systems. The goal is that an IT outage does not stop a production line.
- Tested manual fallbacks. Shipping at "near normal" levels after days suggests the recovery effort was large. A rehearsed manual process shortens that.
- Prioritized restoration order. Decide before an incident which systems return first.
- Immutable, offline backups for the systems that drive orders and inventory.
Try it yourself
Write the 60 minute version of your first day after an outage: who decides materiality, who drafts the disclosure and who tells customers.
Click through it at your own pace, or open it full screen.
Quick check
Does the filing say ransomware was involved?
No. It says unauthorized activity on certain systems caused a network outage. It names no attacker and no method.
When will more financial detail arrive?
The company expects to give a revised outlook on its third quarter earnings call on 28 October 2026.
