12OCT

Boston Scientific likely to miss guidance

3 min read

10:55UTC

Boston Scientific told the SEC on 8 September that an August network outage will likely push its sales growth and earnings below July's guidance.

← Back to China alert puts old bugs on a 3-day clock Jump to analysis ↓

TechnologyAssessed

Key takeaway

Boston Scientific expects its August network outage to push results below July's guidance.

Boston Scientific told the US Securities and Exchange Commission (SEC) on 8 September that a 25 August network outage will likely hit its third-quarter and full-year results⁠¹. It filed under Item 1.05 of the 8-K form, the item for a material cybersecurity incident. The outage disrupted manufacturing and the processing and shipping of orders worldwide, and the company said it is unlikely to meet the net sales growth and adjusted earnings-per-share guidance it gave on 29 July.

At filing, the medical-device maker said its major distribution centres were shipping at or above normal levels and manufacturing had resumed at most sites. It named no attacker and no ransom demand⁠². It promised more detail on its 28 October results call.

Boston Scientific first reported the outage on 26 August and moved it to Item 1.05 a fortnight later. The SEC's four-business-day clock starts when a company decides an incident is material, not when it detects one, which is how a filing 14 days after the outage can still be on time. Stryker, another medical-device maker, declared its March device wipe material in April but kept its full-year guidance; Boston Scientific has gone further and warned on the guidance itself.

Deep Analysis

In plain English

Boston Scientific is a large American company that makes medical devices such as heart stents, pacemakers and tools used in surgery. On 25 August something unauthorised happened on its computer network and parts of it shut down. That disrupted making products and processing and shipping orders to hospitals around the world. US-listed companies must tell the Securities and Exchange Commission (SEC), the stock-market regulator, about serious cyber incidents. Boston Scientific told it on 8 September that the incident will probably mean lower results for the quarter and the year than it had promised investors.

Deep Analysis

Root Causes

Device makers run order intake, manufacturing scheduling and shipping on one global enterprise resource planning system. A network outage that takes that system down stops all three at once, even where factories themselves are untouched.

Hospitals hold thin inventories of many implants and keep consigned stock that the maker replenishes on usage signals. When those signals stop flowing, shipments stop with them.

Boston Scientific moved from its 26 August notice to Item 1.05 on 8 September because the SEC's four-business-day clock starts at the materiality decision, not at detection.

What could happen next?

Consequence
Hospitals may add second suppliers for single-source devices to reduce exposure to one maker's systems.
Precedent
A device maker linking a cyber outage to missed guidance gives other medical-technology boards a benchmark for disclosure.

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: NotPetya hit Merck in June 2017 and halted parts of manufacturing and order handling. Merck had to borrow doses of its Gardasil vaccine from the US Centers for Disease Control stockpile and reported lost sales across two years, the clearest case of a cyber outage turning into a drug and device supply shortfall.

Counter-parallel: Norsk Hydro, hit by LockerGoga ransomware in March 2019, switched plants to manual operation, refused to pay and briefed the market daily. Its production losses stayed contained and it kept investor confidence, showing a manufacturer can absorb an outage without guidance damage when plants can run offline.

The third quarter closed on 30 September, five weeks after the outage began, so lost shipping days fall almost entirely inside it. Sales that were delayed rather than lost should reappear in the fourth quarter as hospitals restock.

The filing gives no figure for the hit. Investors will get one on 28 October, and the split between deferred and lost revenue will matter more to the share price than the headline number.

Consensus view: Boston Scientific's filing locates the damage in order processing and shipping, with sterilisation running and distribution centres back at or above normal levels by 8 September. That points to a revenue-timing problem in the third quarter rather than lasting capacity loss, and the company says it expects no effect on its long-term financial condition.

Counter-view: Stryker took the opposite judgement after its March device wipe, filing a material incident yet holding its full-year guidance. Two device makers reading similar disruption so differently suggests the guidance call reflects how much each could recover inside the year, not the size of the outage.

Key tension: Whether hospitals deferred device orders until Boston Scientific's systems returned, or switched to rival suppliers and will not come back.

Sources:Securities and Exchange Commission

Mentions:Securities and Exchange Commission →Boston Scientific →CDC →Merck & Co. →Stryker Corporation →Norsk Hydro →LockerGoga →NotPetya →

First Reported In

Update #14 · China alert puts old bugs on a 3-day clock

Securities and Exchange Commission· 12 Oct 2026

Read original →

Different Perspectives

ENISA

ENISA's 22 September threat report found only 23.8 per cent of NoName057(16)'s assessed claims were confirmed by independent availability checks, though the group produced 48 per cent of ideology-driven activity. The agency's numbers show public administration taking 31.8 per cent of attacks, mostly ideological DDoS.

LKA Hamburg

Hamburg's State Criminal Police Office led the operation that took the KillSec leak site on 30 September, with ten countries, Europol and Eurojust. Investigators link the group to around 1,000 suspected attacks, at least 70 in Germany, and the seizure blocks access to at least 110 terabytes of victims' data.

ASOS

ASOS said an unauthorised party reached names and contact details on third-party platforms after obtaining an employee's credentials by impersonating a trusted contact. It said it does not believe payment cards or account passwords were affected, and is investigating.

Check Point

Check Point updated its advisory on 20 September to say its 9.8-rated VPN certificate flaw had been exploited on Spark firewalls since 12 September, five days after the advisory first appeared, and shipped fixes including R81.20 Take 166. It told customers using only pre-shared-key VPN communities they were not exposed.

Japan's National Police Agency

Japan's National Police Agency and National Cybersecurity Office signed advisory AA26-281A and published it on 9 October, naming SoftEther VPN, MicroScan and office-cli and indicators detected since January 2016. Tokyo says the evidence comes from several FBI criminal investigations and that it will deepen cooperation with allies.

CISA

CISA gave federal agencies three days to fix five flaws from 2015 to 2023 on the day the China advisory named Integrity Technology Group, and set the same clock on 34 of 43 September listings. It treats a named state-linked operation as reason enough to patch old software within the week.