Boston Scientific discloses cyberattack causing global disruption to operations

Boston Scientific, the U.S. manufacturer of implanted medical devices such as pacemakers and defibrillators, has disclosed that a cyberattack is disrupting its operations worldwide. According to TechCrunch, the company confirmed the incident in a filing with the U.S. Securities and Exchange Commission on Wednesday, describing a "global disruption" to its business.

What the filing says

In the filing, Boston Scientific said it began experiencing disruptions and restricted access to its IT systems and business applications on Tuesday, systems the company considers critical to running its operations. According to TechCrunch, the attack has already affected its ability to ship products and process orders.

What the company has not said is whether the disruption reaches patients who use its implanted devices. When TechCrunch asked spokesperson Chanel Hastings whether patients are affected, what steps they should take, or what kind of attack the company is dealing with, she shared the company's public statement but declined to answer those questions.

That statement says the investigation is ongoing and that there is no timeline yet for restoring the affected systems. Boston Scientific says it treats around 48 million patients a year, according to its website.

Staff sent home in Cork

The cause of the attack has not been established. Local media in Ireland reported that thousands of employees at the company's campus in Cork were sent home on Tuesday after network communications were cut across the organisation, TechCrunch reports.

Public internet records cited by TechCrunch indicate that Boston Scientific relies largely on Microsoft and Amazon Web Services for its corporate infrastructure.

A string of attacks on medical device makers

Boston Scientific is the latest health technology company to be hacked this year. TechCrunch notes that fellow device makers Abbott Laboratories and Medtronic have also faced attacks in recent weeks.

Earlier in the year, Iranian-backed hackers were blamed for a cyberattack on U.S. device maker Stryker, in which the attackers remotely wiped tens of thousands of employee devices across its Windows network after abusing a centralized device management portal provided by Microsoft.

Why it matters

Boston Scientific's products sit inside people's bodies, which is why the unanswered question about patient impact matters more than anything else in the filing. The reported effects so far are operational, covering shipping and order processing rather than clinical functions, but the company's silence leaves room for the worst assumptions.

There is also a supply dimension: a global device maker that cannot ship or process orders can delay deliveries to hospitals and clinics, and no estimate has been given for when normal service will resume.

The incident also fits a wider pattern. Medical device and health technology firms have been repeatedly targeted this year, and Boston Scientific's decision to disclose through a regulatory filing while saying little about the cause or recovery illustrates the position such companies often find themselves in: pressure to confirm an incident quickly, with few firm details to share.