Boston Scientific Begins Restoring Shipping After Cyberattack; Backlog Remains

Boston Scientific has begun restoring shipping for the majority of its products at its major distribution centers globally, the company said in a September 3 update on its website, roughly a week after a cyberattack disrupted its operations.

"As capabilities are validated and brought back online, we are progressively moving customer orders through the fulfillment process," the company said. "It will take time to work through the existing backlog of orders." Boston Scientific said it was working to restore shipping for additional products and locations and to ramp up to full capacity, and that customers could continue to submit orders electronically.

How the disruption unfolded

The company identified the cybersecurity incident on August 25, according to its update. In a securities filing the next day, it said the attack had caused a global disruption to its operations, including the ability to process and ship orders, and that the full scope and impacts were not yet known, MedTech Dive reported. The company's shares fell nearly 6% in premarket trading that day, according to the publication.

In a statement posted on August 27, Boston Scientific said the attack had also affected its ability to manufacture products, which it had not previously disclosed, MedTech Dive reported. The company said then that it could still take orders electronically and place them in a queue for future fulfillment.

By August 30, the company said it saw no indication of unauthorized activity in its environment related to the incident since August 25, that its cloud-based systems and applications were not affected, and that the unauthorized activity was limited to certain on-premise systems.

Investigation and devices

Boston Scientific said it is working with CrowdStrike and other third-party experts. "Working with CrowdStrike and other third-party experts, we have growing confidence that the unauthorized access was limited to select internal-facing IT infrastructure," the September 3 update said. The company said that if it determines personal data was compromised, it will notify affected individuals, regulators and customers.

The company said it knew of no impact on implantable device function or on remote monitoring of devices that were being monitored before the network disruption. It said new remote monitoring communicators for new cardiac rhythm management implants, other than insertable cardiac monitors, could not yet be activated, so data from those devices would not be transmitted to remote patient management systems until activation.

The incident follows a string of cyberattacks on medical device makers in recent months, including Stryker, Medtronic, Abbott and Intuitive, MedTech Dive reported on September 4. Most of those attacks did not disrupt operations, but Stryker's attack in March shut down its ordering, shipping and manufacturing for weeks, the publication said. When Boston Scientific first disclosed its incident, it said it had not yet determined whether it would have a material impact.