Cyber incident briefing · United States / UK · Medical devices / manufacturing

Boston Scientific Cyberattack: Plants and Distribution Centers Shut Down Worldwide

Part 7 of 8 in Recent Cyberattacks: Fall 2026 Briefings

Confirmed by the organizationLast verified: November 1, 2026Reviewed by Ali Hassani, CISSP, C|CISO
Manufacturing managers reviewing operations documents in an industrial facility

Boston Scientific, a global medical-device maker, identified a cybersecurity incident on August 25, 2026 that caused a global disruption to its operations, including order processing and shipping (Boston Scientific 8-K, Aug 26; Boston Scientific 8-K, Sept 8). Its chief executive later said all plants and distribution centers had been shut down worldwide (MedTech Dive), and NHS Supply Chain in England issued a supply-disruption notice to hospitals (NHS Supply Chain notice). The company has not said how the attackers got in, but its recovery shows what it takes to bring a manufacturer back online.

OrganizationBoston Scientific Corporation, medical-device manufacturer
WhenIncident identified August 25, 2026 (Boston Scientific 8-K, Sept 8)
ImpactGlobal disruption to operations, including order processing and shipping (Boston Scientific 8-K, Aug 26); new remote-monitoring activations for some cardiac implants affected (Boston Scientific update, Sept 3)
ScopeThe company said activity was limited to certain on-premise systems and cloud systems were not affected (Boston Scientific update, Aug 30)
FinancialCompany said the incident is likely to have a material impact on results and it was unlikely to meet its guidance (Boston Scientific 8-K, Sept 8)
StatusOperations reported fully restored in September; no evidence of ongoing threat activity since containment (MedTech Dive)

Each item is linked to its source. Verification status reflects the strongest source available on the verification date.

What happened

  1. Aug 25. Boston Scientific identifies the incident and begins containment (Boston Scientific 8-K, Sept 8; MedTech Dive).
  2. Aug 26. First 8-K reports a global disruption with no restoration timeline yet (Boston Scientific 8-K, Aug 26). A spokesperson declines to say whether ransomware was involved (The Record).
  3. Aug 27. NHS Supply Chain opens a supply-disruption notice for hospitals in England (NHS Supply Chain notice).
  4. Aug 30. The company says cloud systems were not affected and it is working with CrowdStrike and other outside experts (Boston Scientific update, Aug 30).
  5. Sept 3. Shipping begins to resume at major distribution centers; the company says it is still investigating whether data was involved (Boston Scientific update, Sept 3).
  6. Sept 8. Second 8-K says the incident is likely material and no ongoing unauthorized access has been found (Boston Scientific 8-K, Sept 8).
  7. Sept 11. Trade press reports manufacturing, order fulfillment and shipping fully restored (MedTech Dive). NHS Supply Chain closes its notice on September 25 (NHS Supply Chain notice).

What is still unknown

  • How the attackers got in and what the root cause was.
  • Whether ransomware was involved; the company declined to say (The Record).
  • Who was responsible. No group had claimed the attack in the sources reviewed.
  • Whether personal data was affected, and the dollar cost.

How manufacturers can reduce downtime from an attack

General practices drawn from the CISA #StopRansomware Guide (CISA #StopRansomware Guide) and common recovery lessons:

  1. Separate production and plant systems from office IT so an office-network incident does not stop the line.
  2. Keep tested, offline backups of the systems that run ordering, shipping and production (CISA #StopRansomware Guide).
  3. Document manual workarounds for orders and shipping before you need them.
  4. Put an incident response firm on retainer and agree on the first steps in advance.
  5. Map which customers depend on you, and how you will tell them about delays.

How OC Security Audit can help

We help manufacturers and engineering firms test segmentation, backups and recovery plans against an operational outage.

Ali Hassani, CISSP, C|CISO, is based in Irvine and works with organizations on-site across Southern California and remotely nationwide.

Schedule a consultationCall 949-777-5567

An audit shows where your controls are weak and what to fix first. No audit or service can guarantee that an organization will not be attacked; the goal is to lower the likelihood and the impact.

More in this series

PreviousMathspace: unpatched reporting tool, 1M+ peopleFirstBinance hack: $6.3B from hot walletsNextMcKesson: data taken from third-party apps

See all briefings and their verification status in the recent cyberattacks and data breaches tracker.

Sources

  1. Boston Scientific, SEC Form 8-K, August 26, 2026. https://www.sec.gov/Archives/edgar/data/0000885725/000088572526000056/bsx-20260826.htm
  2. Boston Scientific, SEC Form 8-K, September 8, 2026. https://www.sec.gov/Archives/edgar/data/0000885725/000088572526000059/bsx-20260907.htm
  3. Boston Scientific, August 30, 2026. https://news.bostonscientific.com/8-30-26-cyber-archive
  4. Boston Scientific, September 3, 2026. https://news.bostonscientific.com/9-3-26-cyber-update-archive
  5. NHS Supply Chain, August 27 to September 25, 2026. https://www.supplychain.nhs.uk/icn/supplier-update-boston-scientific-cyber-attack/
  6. MedTech Dive, September 11, 2026. https://www.medtechdive.com/news/boston-scientific-fully-restores-operations-after-cyberattack/830182/
  7. The Record, August 26, 2026. https://therecord.media/boston-scientific-cyberattack-disrupts-shipment-processes
  8. CISA, accessed November 1, 2026. https://www.cisa.gov/stopransomware/ransomware-guide

About this briefing. This page summarizes publicly available information from the sources linked above, as of the verification date shown. OC Security Audit was not involved in responding to any incident described here and has no inside knowledge of them. Organization names are used only to identify the subjects of the cited public reports. Statements made by attackers are labeled as claims and are not treated as fact; details that the sources do not confirm are marked as unknown. Facts may change as investigations continue.

This content is for general educational purposes. It is not legal advice, a forensic conclusion or a finding about any organization’s security practices. See our editorial standards. To report an error, contact support@OCsecurityAudit.com and we will review it and publish a dated correction where needed.