Boston Scientific in MedDevice Cyber coverage: 17 stories, 5 products named, 9 CVEs, and the company's own disclosures.
Boston Scientific told analysts on October 28 that an eight-day cyber outage cut third quarter sales by $150 million, the first dollar figure it has attached to the August attack. The company also cut full year guidance for the third time and announced a restructuring program targeting $500 million in savings.
AdvaMed's board chair says the group will treat cybersecurity like a code of ethics after Stryker, Boston Scientific, Medtronic, Abbott and Intuitive all reported attacks this year.
CrowdStrike's investigation into Boston Scientific's August cyberattack found no evidence the intruder accessed or exfiltrated patient, customer, or business data, the company said September 22.
Citigroup downgraded Boston Scientific from buy to neutral on September 18 and cut its price target to $50 from $57, citing the slow recovery from the August 25 cyberattack alongside competitive pressure on Watchman. The stock has fallen about 13 percent in a month.
Boston Scientific CEO Mike Mahoney told the Wells Fargo Healthcare Conference on September 11 that all of the company's plants and distribution centers were shut down globally during its August cyberattack, and that it still cannot pinpoint a dollar impact ahead of the October 28 earnings call.
Boston Scientific said late on September 9, 2026 that manufacturing, order fulfillment and shipping are fully restored, two weeks after a cyberattack shut down plants and distribution centers worldwide. CrowdStrike found no evidence of ongoing compromise, but the company still cannot put a dollar figure on the hit to third quarter and full year guidance, with updated numbers due October 28.
Boston Scientific filed a second 8-K on September 8, 2026, this time under Item 1.05, saying the incident it identified on August 25 is likely to have a material impact on third quarter and full year results. The company is unlikely to meet the net sales growth and adjusted EPS ranges it issued on July 29. Distribution, sterilization and most manufacturing are running again, shares fell more than 4 percent to $45.73, and no ransomware group has claimed the attack.
Boston Scientific said in a September 3, 2026 update that it has begun restoring shipping capabilities for the majority of its products at its major distribution centers globally. The company reports growing confidence that the unauthorized access was limited to select internal-facing IT infrastructure, with no unauthorized activity detected since August 25. Whether personal data was compromised is still under investigation.
Boston Scientific said in an August 30, 2026 update that it sees no indication of unauthorized activity in its environment since August 25 and expects to begin shipping some products this week. The attack hit certain on-premise systems running manufacturing, order processing, and shipping, while cloud systems were unaffected. CrowdStrike is working the investigation, and new cardiac remote monitoring activations remain paused.
Boston Scientific said on August 28, 2026 that the cyberattack detected on August 25 has stopped product manufacturing in addition to order processing and shipping. Orders can be taken electronically and queued, but not filled, and there is no restoration timeline. The Cork plant on Model Farm Road cancelled all Friday shifts, and implanted cardiac devices keep working while new remote monitoring activations are paused.
Boston Scientific detected a cyberattack on August 25, 2026 and disclosed it in an 8-K the next day: a network outage has cut access to operating systems and business applications, including processing and shipping customer orders, across global operations. Restoration timing is unknown, shares fell nearly 6 percent premarket, and thousands of Cork staff were sent home. No attacker has been named.
Boston Scientific's March 8, 2022 alert covers CVE-2022-25249 and CVE-2022-25252 in Axeda software on the Model 3300 LATITUDE Programming System; exploitation requires physical access, and a planned Axeda replacement is under way.
CISA advisory ICSMA-21-273-01 lists five physical-access vulnerabilities in the Boston Scientific ZOOM LATITUDE PRM Model 3120, including unsigned software installation (CVE-2021-38396) and a weak password hash (CVE-2021-38400, CVSS v3 6.9). There is no update; users are moving to the LATITUDE Programming System Model 3300.
Boston Scientific's September 16, 2020 statement on BootHole, CVE-2020-10713, rates the risk to its Linux and Windows Secure Boot devices as low and defers patches to the next scheduled software update.
Boston Scientific's June 25, 2020 statement says the Treck TCP/IP software behind Ripple20 is used in its transvenous implantable cardiac devices, programmers and LATITUDE systems, not S-ICDs, and poses no increased security risk to patients.
Boston Scientific's January 3, 2020 statement says two SonicWall firewall appliances sold as optional Network Security Devices for the iLAB and POLARIS imaging systems are affected by the URGENT/11 IPnet TCP/IP stack vulnerabilities.
CISA advisory ICSMA-17-292-01 reports a hard-coded cryptographic key (CVE-2017-14014) and unencrypted PHI at rest (CVE-2017-14012) in all versions of the Boston Scientific ZOOM LATITUDE PRM Model 3120. Boston Scientific will not issue a product update.
Boston Scientific products with the device attributes their own public documentation states, and the advisories in our coverage that share those attributes.
| Product | Device type | Attributes | Matched advisories |
|---|---|---|---|
| TheraSphere 360 Y-90 Management Platform | System, Image Processing, Radiological | 24 | 35 |
| LUX-Dx II (M302); LUX-Dx II+ | Recorder, Event, Implantable Cardiac, (With Arrhythmia Detection) | 26 | 19 |
| iLab Polaris Multi-Modality Guidance System | Computer, Diagnostic, Programmable | 22 | 15 |
| BodyGuardian Remote Monitoring System | Detector And Alarm, Arrhythmia | 20 | 8 |
| Flexiva Pulse Laser Fiber | Powered Laser Surgical Instrument | 5 | 7 |
| AVVIGO Guidance System | Computer, Diagnostic, Programmable | 13 | 1 |
| LithoVue Elite Digital Flexible Ureteroscope System | Ureteroscope And Accessories, Flexible/Rigid | 9 | 1 |
| LUX-Dx Insertable Cardiac Monitor | Recorder, Event, Implantable Cardiac, (With Arrhythmia Detection) | 30 | 1 |
| Autotome Pro RX 39 Sphincterotome | Unit, Electrosurgical, Endoscopic (With Or Without Accessories) | 1 | 0 |
| AVVIGO Guidance System II | Computer, Diagnostic, Programmable | 17 | 0 |
| AVVIGO+ Multi-Modality Guidance System | Computer, Diagnostic, Programmable | 17 | 0 |
| AXIOS Stent and Electrocautery Enhanced Delivery System | Pancreatic Stent, Covered, Metallic, Removable | 1 | 0 |
| Captivator Single-Use Polypectomy Snares | Snare, Flexible | 1 | 0 |
| EKOS+ Endovascular Device | Mechanical Thrombolysis Catheter | 3 | 0 |
| EkoSonic Endovascular Device, EKOS+ Endovascular Device | Mechanical Thrombolysis Catheter | 1 | 0 |
| EluPro Antibiotic-Eluting BioEnvelope | Mesh, Surgical | 2 | 0 |
| EXALT Monitor | 5 | 0 | |
| FARADRIVE Steerable Sheath | Catheter, Steerable | 3 | 0 |
| Gold Probe Bipolar Electrohemostasis Catheter | Unit, Electrosurgical, Endoscopic (With Or Without Accessories) | 1 | 0 |
| GX1 Radiofrequency Generator Kit (RFG-X1-120V) | Generator, Lesion, Radiofrequency | 6 | 0 |
| Habib EndoHPB | Unit, Electrosurgical, Endoscopic (With Or Without Accessories) | 1 | 0 |
| ICEfx Cryoablation System | Unit, Cryosurgical, Accessories | 6 | 0 |
| IceSeed 1.5 CX 90º Needle (H7493967433170) | Unit, Cryosurgical, Accessories | 1 | 0 |
| IceSeed 1.5 CX Straight Needle (H7493968333170) | Unit, Cryosurgical, Accessories | 1 | 0 |
| iNod Ultrasound Guided Biopsy Needle (UPN: M00502060) | Bronchoscope (Flexible Or Rigid) | 7 | 0 |
| IntellaMap Orion High Resolution Mapping Catheter | Catheter, Electrode Recording, Or Probe, Electrode Recording | 5 | 0 |
| LUX-Dx II Insertable Cardiac Monitor (M302) | Recorder, Event, Implantable Cardiac, (With Arrhythmia Detection) | 30 | 0 |
| Moses 200 D/F/L Laser Fiber (M0068130100) | Powered Laser Surgical Instrument | 4 | 0 |
| Nalu Neurostimulation System | Stimulator, Spinal-Cord, Implanted (Pain Relief) | 5 | 0 |
| OptiMap System | Computer, Diagnostic, Programmable | 7 | 0 |
| ORISE ProKnife | Unit, Electrosurgical, Endoscopic (With Or Without Accessories) | 1 | 0 |
| Rezum System | Unit, Electrosurgical, Endoscopic (With Or Without Accessories) | 1 | 0 |
| RIVOS EUS Access Device | Endoscopic Ultrasound System, Gastroenterology-Urology | 1 | 0 |
| StoneSmart Connect Console | Ureteroscope And Accessories, Flexible/Rigid | 6 | 0 |
| Visual-ICE Cryoablation System | Unit, Cryosurgical, Accessories | 1 | 0 |
| ZelanteDVT THrombectomy System | Peripheral Mechanical Thrombectomy With Aspiration | 7 | 0 |