Two weeks after Boston Scientific called its August cyberattack likely material, the company still cannot put a number on it. CEO Mike Mahoney told investors at the Wells Fargo Healthcare Conference on September 11 that it is hard to pinpoint the exact dollar amount at this point, even as the company confirmed it will miss its third quarter and full year 2026 sales and earnings guidance.
Mahoney's remarks filled in scope that Boston Scientific's earlier updates had left vague. All of the company's plants were shut down and distribution centers were shut down globally, he said, a wider scale than the plant-by-plant language in the August 26 and August 28 filings. Cardiac and other device manufacturing stopped alongside order processing and shipping after the August 25 intrusion hit on-premise IT systems.
The shutdown cost the company orders it will not get back. Mahoney said hospitals in regions with inadequate inventory placed contingent orders with other suppliers while Boston Scientific's plants sat idle, and many of those orders are gone for good. The company has not disclosed how many procedures or how much revenue that represents, and will not until its October 28 earnings call.
CrowdStrike, retained for the incident response, has found no evidence of ongoing threat activity or compromise to Boston Scientific's systems or products since containment on August 25. Manufacturing, order fulfillment and shipping were fully restored by September 9, roughly two and a half weeks after detection. Mahoney's comments two days later were the company's first public attempt to quantify the damage, however incomplete.
A materiality determination under Item 1.05 does not require a dollar figure at filing. It requires one eventually, and Boston Scientific now has an earnings call on the calendar that will supply it.