Update on recent cybersecurity incident

Update on recent cybersecurity incident
Sep 1, 2026

• Company news

Latest update — September 1, 2026 8:44 p.m. ET

We understand that customers, suppliers, patients and other stakeholders have questions about the cybersecurity incident and want additional information as quickly as possible. Although it will take time, we are committed to providing accurate, validated information as the investigation progresses, which is currently ongoing. 

We recognize the challenges incidents like this can create for customers, patients and suppliers, and we appreciate your patience, trust and continued partnership as we work through this situation.    

The latest information about the incident as it becomes available is on our website and we also address several frequently asked questions below

Frequently Asked Questions:  

What happened?  

• On August 25, Boston Scientific identified a cybersecurity incident affecting certain information technology systems that resulted in a network outage and disruption to the company’s operations.
• Once detected, we activated incident response protocols and began an investigation to assess the threat with the assistance of CrowdStrike and other third-party experts.   

When was the incident identified?  

• Boston Scientific identified the cybersecurity incident on August 25, 2026. 

When did containment efforts begin? 

• Once detected, we immediately activated incident response protocols and began an investigation to assess the threat with the assistance of CrowdStrike and other third-party experts.   

Are you engaging in forensic investigation? 

• Yes. CrowdStrike and other third-party experts are engaged for investigation support and forensics. 

Has personal data been compromised? 

• At this time, we are investigating and working diligently to restore affected functions and systems access.
• If we determine personal data has been compromised, we will take appropriate steps, such as notifying affected individuals, regulators and customers and provide support services in accordance with privacy laws.

 What areas of the company are impacted?  

• The incident is affecting access to certain operating systems and business applications, including the ability to manufacture products, as well as process and ship customer orders. We are working to resume these operations as quickly as possible.
• We continue to be able to intake orders electronically (through EDI and local applications) and place them in a queue for future fulfillment. The investigation into the cybersecurity incident is ongoing. The company is working diligently to restore affected functions and systems access. 

Can we communicate with Boston Scientific employees? 

• Customers and vendors may continue communicating and exchanging information with Boston Scientific through their normal channels, including with sales representatives and other employees, in email and established digital platforms and connections.   

Have device operations, software services or customer-facing systems been affected by the incident? 

• Based on our ongoing assessment, there is:
  • No known impact to devices not connected to a Boston Scientific network.
  • No known impact to the ability of clinicians to use devices that are not connected to a Boston Scientific network.
  • No evidence that the affected Boston Scientific network environment has created increased cybersecurity risk to hospital networks using Boston Scientific devices.
  • Specifically for Cardiac Rhythm Management devices*:
    • No known impacts to implantable device function or the ability for remote patient monitoring of a device that was remotely monitored prior to the network disruption. Programmer interrogations are not impacted. 
    • New remote monitoring activations are impacted by the disruption:
    • For new cardiac device implants — CRM devices other than insertable cardiac monitors (ICM): New remote monitoring communicators cannot be activated, thus available device data will NOT be transmitted to remote patient management systems until the communicator can be activated.
    • For new ICM device implants: Newly implanted ICMs must be activated using the Boston Scientific Clinic Assistant app to enable the ICM to properly record episodes. New ICMs are unable to pair to the patient remote monitoring mobile phone, therefore available episode data recorded by the ICM will NOT be transmitted to the remote monitoring system until the ICM can be paired to the patient mobile app. Episodes will continue to be recorded by the ICM and can be transmitted to the remote monitoring system via an in-person interrogation with the Clinic Assistant app by selecting the “Interrogate” button.
    • Once systems are restored and pairing with home monitoring equipment occurs, the device will transmit recorded data to the remote monitoring system. Timeline for full restoration is not yet known. Updates will be provided when these functions are restored. 

​*Cardiac Rhythm Management (CRM) devices referenced include Cardiac Implantable Electronic Devices (CIEDs) such as CRT-Ds, ICDs, CRT-Ps, PMs, S-ICDs, ICMs. Boston Scientific is continuing to investigate the incident and will provide updates as soon as they are available. 

What are your next steps? 

• Working with CrowdStrike and other third-party experts, we continue to take containment steps based on our plan and have made positive progress.
• We are working diligently to restore affected functions and systems.
• Additionally, we know that our customers have questions about ordering and shipping products. Our confidence in restoring these operations and access continues to increase, and we are expeditiously working towards partial restoration for the shipping of some products this week. Once we can demonstrate the restoration is fully operable, we anticipate ordering and shipping will ramp up to full capacity. We continue to be able to intake orders electronically (through EDI and local applications) and place them in a queue for future fulfillment.   

How/when will we know when it is safe to resume normal operations? 

• We will continue to provide updates as new information as appropriate. 
• Our teams are actively working to investigate the incident and restore affected services. 
• As we gain additional clarity, we will work closely with our customers and suppliers to communicate when normal operations are expected to resume and when it is safe to return to standard business processes. 

When will you provide more information? 

• We expect to provide updates on our website as appropriate. Our investigation of the cybersecurity incident is ongoing and we are working diligently to restore affected functions and systems. 

Why haven’t systems been fully restored? 

• Responding to cybersecurity incidents requires a multi-phase activity. This includes internal and external experts, sophisticated forensic tools to collect and analyze evidence and assessing, and that our systems are ready to support normal operations. We appreciate your patience as we work through these important steps. 
   

Latest update — August 30, 2026 8:25 p.m. ET

The investigation into the global network disruption to certain Boston Scientific operating systems and business applications as a result of a cybersecurity incident is ongoing and we continue to work with CrowdStrike and other third-party cybersecurity experts.  

Based on our investigation to date, we can share that: 

• We see no indication of unauthorized activity in our environment related to this incident since August 25.
• ​There is no impact to our cloud-based systems and applications, and the unauthorized activity is limited to certain on-premise systems.  

Ordering and shipping update  

Additionally, we know that our customers have questions about ordering and shipping products. 

Our confidence in restoring these operations and access continues to increase, and we are expeditiously working towards partial restoration for the shipping of some products this week. 

Once we can demonstrate the restoration is fully operable, we anticipate ordering and shipping will ramp up to full capacity. 

We continue to be able to intake orders electronically (through EDI and local applications) and place them in a queue for future fulfillment.   

We recognize the challenges incidents like this can create for customers, patients and suppliers and we appreciate your patience, trust and continued partnership as we work through this situation.   
 

August 29, 2026 4:55 p.m. ET

Systems updates

The investigation into the cybersecurity incident is ongoing and we continue to work with CrowdStrike and other third-party cybersecurity experts

At this time, our investigation indicates there is no impact to our cloud-based systems and applications and that the unauthorized activity is limited to certain on-premise systems. 

Communicating with Boston Scientific

Customers may continue communicating and exchanging information with Boston Scientific through their normal channels, including with sales representatives and other employees, in email and established digital platforms and connections.  

While the timeline for a full restoration is not yet known, we are currently working on restoring affected functions and systems access

Ordering and shipping — customers can continue to place orders 

The incident is affecting access to certain operating systems and business applications, including the ability to manufacture products, as well as process and ship customer orders. We are working to resume these operations as quickly as possible

We are able to intake orders electronically (through EDI and local applications) and place them in a queue for future fulfillment. 

We recognize the challenges incidents like this can create for customers, patients and suppliers and we appreciate your patience, trust and continued partnership as we work through this situation.  
 

August 28, 2026 7:34 p.m. ET

Cybersecurity update on Boston Scientific products

The investigation into the cybersecurity incident is ongoing. While we are working diligently to restore affected functions and systems access, the timeline for a full restoration is not yet known. Based on our ongoing assessment, currently we believe there is:

• No known impact to devices not connected to a Boston Scientific network.
• No known impact to the ability of clinicians to use devices that are not connected to a Boston Scientific network.
• No evidence that the affected Boston Scientific network environment has created increased cybersecurity risk to hospital networks through use of Boston Scientific devices.
• Specifically for Cardiac Rhythm Management devices*:
  • No known impacts to implantable device function or the ability for remote patient monitoring of a device that was remotely monitored prior to the network disruption. Programmer interrogations are not impacted.
  • New remote monitoring activations are impacted by the disruption:
    •  For new cardiac device implants — CRM devices other than insertable cardiac monitors (ICM): New remote monitoring communicators cannot be activated, thus available device data will NOT be transmitted to remote patient management systems until the communicator can be activated.
    • For new ICM device implants: Newly implanted ICMs must be activated using the Boston Scientific Clinic Assistant app to enable the ICM to properly record episodes. New ICMs are unable to pair to the patient remote monitoring mobile phone, therefore available episode data recorded by the ICM will NOT be transmitted to the remote monitoring system until the ICM can be paired to the patient mobile app. Episodes will continue to be recorded by the ICM and can be transmitted to the remote monitoring system via an in-person interrogation with the Clinic Assistant app by selecting the “Interrogate” button.
    • Once systems are restored and pairing with home monitoring equipment occurs, the device will transmit recorded data to the remote monitoring system. Timeline for full restoration is not yet known. Updates will be provided when these functions are restored.

*Cardiac Rhythm Management (CRM) devices referenced include Cardiac Implantable Electronic Devices (CIEDs) such as CRT-Ds, ICDs, CRT-Ps, PMs, S-ICDs, ICMs. Boston Scientific is continuing to investigate the incident and will provide updates as soon as they are available.
 

August 27, 2026 11:38 p.m. ET

We recognize the challenges incidents like this can create for customers, patients and suppliers and we appreciate your patience, trust and continued partnership as we work through this situation.  

This page will continue to serve as Boston Scientific’s ders. 

About the incident 

A cybersecurity incident continues to affect certain information technology systems, and we remain in a network outage with disruption to our operations. Once detected, we activated incident response protocols and have continued our investigation to assess the threat with the assistance of cybersecurity and other third-party experts.  

The incident is affecting access to certain operating systems and business applications, including the ability to manufacture products, as well as process and ship customer orders. 

The investigation into the cybersecurity incident is ongoing. While we are working diligently to restore affected functions and systems access, the timeline for a full restoration is not yet known. 

Product updates  

We recognize the importance of cybersecurity for patients, customers and vendor systems. Patients and physicians are at the center of our recovery effort. We are working to maintain continuity of supply. Further, Boston Scientific continues to investigate potential impact to patients’ implanted devices or to devices that connect to networks across our product portfolio and will provide updates as soon as they are available. 

Our investigation to date demonstrates no impact to implantable cardiac rhythm management (CRM) device function. It also doesn’t impact the device’s ability to transmit data, or healthcare professionals’ ability to access remote patient management data for CRM devices remotely monitored prior to the network disruption. Additionally, there is no evidence of increased cybersecurity risks or difficulties transferring data from CRM remote monitoring systems to electronic medical records (EMR) systems. 

However, new remote monitoring activations are impacted by this disruption: 

• For new cardiac device implants — CRM devices other than insertable cardiac monitors (ICM): New remote monitoring communicators cannot be activated, thus available device data will NOT be transmitted to remote patient management systems until the communicator can be activated. Programmer interrogations are not affected by this system disruption.
• ​For new ICM device implants: Newly implanted ICMs must be activated using the Boston Scientific Clinic Assistant app to enable the ICM to properly record episodes. New ICMs are unable to pair to the patient remote monitoring mobile phone, therefore available episode data recorded by the ICM will NOT be transmitted to the remote monitoring system until the ICM can be paired to the patient mobile app. Episodes will continue to be recorded by the ICM and can be transmitted to the remote monitoring system via an in-person interrogation with the Clinic Assistant app by selecting the “Interrogate” button. 

Once systems are restored and pairing with home monitoring equipment occurs, the device will transmit recorded data to the remote monitoring system. Timeline for full restoration is not yet known. Updates will be provided when these functions are restored. 

Ordering and shipping — customers can continue to place orders 

While we are currently unable to process or ship customer orders, we are able to intake orders electronically (through EDI) and place them in a queue for future fulfillment. 

Communicating with your Boston Scientific sales representative 

Customers may continue communicating and exchanging information with Boston Scientific through their normal channels, including with sales representatives and other employees, in email and established digital platforms and connections.  

Please continue to outreach to your sales representative during this time to address questions.  

Next steps for restoration and recovery 

We are directing reers and product delivery and have engaged external experts to assist in the restoration and recovery efforts. Progress is being made in recovering our core business system and we will provide further updates as functionality is restored. 
 

August 26, 2026

On August 25, Boston Scientific identified a cybersecurity incident affecting certain information technology systems that resulted in a network outage and disruption to the company’s operations. Once detected, the company activated incident response protocols and began an investigation to assess and contain the threat with the assistance of third-party cybersecurity experts. The incident has impacted access to certain operating systems and business applications, including the ability to process and ship customer orders.

The investigation into the cybersecurity incident is ongoing. While the company is working diligently to restore affected functions and systems access, the timeline for a full restoration is not yet known

The company filedan 8k on this incident and will provide updates on this webpage as appropriate

Top

Source: news.bostonscientific.com