Incident update

Boston Scientific puts the August cyberattack at $150 million of lost third quarter sales

MedDevice Cyber Staff · 3 days ago · 3 min read · Via MedTech Dive

Boston Scientific said an eight-day cyber outage reduced third quarter sales by $150 million. The company disclosed the figure on its October 28 earnings call. The August attack stopped order processing, manufacturing and shipping worldwide while it ran.

It is the first hard number attached to the incident. On September 8 the company filed an Item 1.05 disclosure calling the attack material and stepped away from its 2026 guidance. Shipping returned for most products on September 3, operations were fully restored on September 9, and the forensic investigation closed on September 22 with no evidence that data had been taken.

The accounting did not stop at the quarter. Full year revenue growth guidance came down to 4.25 percent, the third cut this year, against a February forecast of 10.5 to 11.5 percent. Fourth quarter sales are now expected to fall 1 to 3 percent. The company also announced a restructuring program targeting $500 million in savings over three years, and shares opened near 7 percent lower at $42.02.

Eight days priced at $150 million is about $19 million of revenue a day moving through order entry and shipping systems. For comparison, Stryker was still carrying roughly $45 million a quarter six months after its own attack. Downtime at a large manufacturer is now a line item that analysts model, not an IT footnote.

Are you a representative of Boston Scientific? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

A hospital that single-sources an implant or disposable from one manufacturer carries that manufacturer's downtime on its own schedule. Work out which Boston Scientific product families in your inventory have no qualified second source, and set par levels that cover an eight-day interruption rather than a two-day one. Ask the vendor in writing how long order entry, manufacturing and shipping can run in degraded mode, and get the answer into the supply agreement.

Map single-source dependencies by product family List the device families where one manufacturer is the only qualified supplier for a scheduled procedure, and mark which of those have a validated substitute on the shelf.
Set par levels against an eight-day outage The Boston Scientific outage ran eight days before shipping resumed for most products. Size buffer stock for scheduled cases against that length, not against normal lead time variance.
Put degraded-mode commitments in the contract Ask suppliers for their documented manual order entry and emergency shipment process, the contact path during an outage, and the notification clock. Record the answers at renewal.

For Device ManufacturersFix the class in the product

The loss here came from order-to-cash and plant systems going down together, which is what happens when enterprise IT and manufacturing execution share identity, network and backup infrastructure. Segment them so that an enterprise compromise cannot stop the line, and keep an order intake path that works when the primary system is isolated. Then exercise it, because a manual fallback that has never been run takes days to stand up under pressure.

Separate manufacturing execution from enterprise identity Give plant systems their own authentication domain and administrative accounts so that containment on the corporate side does not require stopping production.
Keep an offline order intake and allocation process Document how orders are received, prioritized and confirmed when ERP is unavailable, including who may authorize emergency shipments for implants and life-sustaining devices.
Rehearse the shipping restart sequence Run a tabletop that starts at containment and ends with the first validated shipment, and time it. The gap between containment and shipping is where the revenue goes.

Questions & Answers

How much revenue did the Boston Scientific cyberattack cost in the third quarter of 2026?

Boston Scientific said on October 28, 2026 that an eight-day outage caused by the August cyberattack reduced third quarter sales by $150 million. That was the first dollar figure the company attached to the incident.

Is Boston Scientific still affected by the August 2026 cyberattack?

Boston Scientific restored operations on September 9, 2026 and closed its forensic investigation on September 22, 2026 with no evidence that data had been taken. The financial effects continue: on October 28, 2026 the company cut full year revenue growth guidance to 4.25 percent and announced a restructuring program targeting $500 million in savings over three years.

Did the Boston Scientific cyberattack delay the Penumbra acquisition?

Boston Scientific now expects its $14.5 billion acquisition of Penumbra to close in early 2027 instead of 2026. CEO Mike Mahoney attributed the delay to the regulatory process rather than to the August 2026 cyberattack.

← Back to Intelligence