Business

Boston Scientific puts $150m sales hit on August cyber attack

Boston Scientific says its August cyber attack cut Q3 organic growth by 300bp, about $150m of sales, with more pain in Q4. Lessons for UK boards.

Falling bar chart illustration for Boston Scientific's cyber attack earnings hit

Boston Scientific has put a figure on its August cyber attack: about 300 basis points of third-quarter organic growth, which on management’s estimate comes to roughly $150m of sales. It expects another hit in the fourth quarter, and that should change how UK boards price operational cyber risk.

What happened

Boston Scientific, the US medical device maker with annual revenue of around $20bn, reported third-quarter 2026 results on 28 October 2026. It detected an intrusion on 25 August and filed a Form 8-K the next day. A second filing on 8 September warned of a probable material effect on quarterly and full-year results.

Net sales for the quarter were $5.138bn, up 1.5% on an organic basis. Before the attack the company had guided to 3% to 5%. On the earnings call, chief financial officer Jon Monson estimated that the incident took about 300 basis points off organic growth. He put that at roughly $150m of lost sales. Management also said the attack cut adjusted earnings per share by about $0.07, through lost revenue and extra costs such as expedited shipping and outside expert support. Adjusted EPS came in at $0.73, against $0.75 a year earlier.

The damage continues into the next quarter. Boston Scientific expects a further 200 to 300 basis points of impact and $0.04 to $0.05 of EPS in the fourth quarter, and guided to a fall in Q4 sales of between 1% and 3%. Investors had already sold the stock heavily this year, and they marked it down by about 8% on the day.

The detail

Boston Scientific has not said how the attackers got in. It has not confirmed whether ransomware was used, data stolen or a ransom demanded, and HIPAA Journal reported in September that no group had claimed responsibility. What it has described is the operational effect.

A network outage cut off access to some operating systems and business applications. That disrupted order processing, manufacturing and shipping worldwide, and staff at its manufacturing sites in Cork, Ireland were sent home. On the call, management said that for about eight business days the company could not make or ship product. Chief executive Mike Mahoney described a two-week outage and said every operation was running again by 8 September.

Several knock-on effects appear in the numbers:

  • Margin damage, not just lost sales. Adjusted gross margin fell 300 basis points to 68.0%. Management blamed this mainly on poor manufacturing absorption while the disruption lasted: factories still carry their fixed costs when production stops.
  • Uneven hits by product line. Management attributed about half of the electrophysiology shortfall to the incident, mostly outside the US. Cardiac rhythm management suffered because remote monitoring of patients’ devices was disrupted while systems were down. Urology, endoscopy and parts of the Asia Pacific and EMEA business were also affected.
  • Distorted timing. Customers built up stock again late in the quarter, which pulled some demand forward and helps explain the weaker Q4 guide.

The insurance question was not addressed: the call transcript records no discussion of cyber cover or claims. Boston Scientific also stresses that the attack is not its only problem. China pricing pressure and competition in pulsed field ablation weighed on several businesses, and management already expects 2027 to be “the trough in the cycle”.

Timeline of the Boston Scientific cyber attack from detection on 25 August to the Q3 earnings hit reported on 28 October 2026

Why it matters for UK organisations

UK boards have seen this pattern before. Marks & Spencer reported £131.3m of costs from its April 2025 attack in its results for the year to March 2026, after it had to stop taking online orders. Boston Scientific adds a manufacturing example on a short timescale. A disruption of about eight business days, contained within weeks, still cost a quarter’s growth and leaves a further hit to come.

Three points stand out for UK organisations. First, operational technology and enterprise IT rarely fail separately. Losing order processing and business applications was enough to stop shipments, even with factory equipment intact. Second, the costs show up in places a simple model misses: under-absorbed overheads, expedited logistics, outside incident response, lost share in competitive product lines and lumpy customer reordering. Third, many UK organisations rely on suppliers like this. NHS trusts, distributors and contract manufacturers in the UK depend on device and component makers, and a two-week outage at a major supplier moves straight down that chain.

Expert view

In my experience, the questions that matter most in an incident like this are rarely technical: how long can you trade without your ERP, order management and identity systems? When we test manufacturers, initial access is usually not the hard part. What decides how long recovery takes is how flat the network is, how far core business applications rely on a single directory, and whether anyone has rehearsed shipping product manually.

Boston Scientific’s recovery looks fast by industry standards: production was back within about two weeks, with backlog shipping above normal rates soon after. Even so, the bill is large. That should worry any board that treats a quick restore as a good outcome. Restore time matters, but so do the hours before it, when the factories still carry their costs and competitors pick up the orders.

The lack of any comment on insurance is worth noticing too. Policy limits, waiting periods and business-interruption definitions often decide whether cover pays out at a scale like this. That is something to check with your broker before an incident, not after.

What to do now

  1. Quantify a realistic outage. Model a two-week loss of core business applications, not just of servers. Include under-absorbed fixed costs, expedited freight, outside incident response and lost competitive sales, and take the result to the board.
  2. Segment the network that runs production and fulfilment. Separate operational systems from corporate IT, so that losing email or a directory does not halt manufacturing or shipping. This builds on the Cyber Essentials firewall and secure configuration controls.
  3. Harden identity. Enforce MFA for all remote and privileged access, remove standing administrator rights and protect directory services as crown jewels. This covers the user access control requirements in Cyber Essentials.
  4. Keep patching and backups sound. Apply security updates within Cyber Essentials timeframes, and keep tested, offline or immutable backups of ERP and order systems along with a documented order to restore them in.
  5. Rehearse manual operations. Agree how you would take, prioritise and ship orders for a fortnight without core systems, and exercise it with operations and finance staff, not only IT.
  6. Review cyber cover and supplier dependencies. Check business-interruption limits, waiting periods and how losses are measured, and ask critical suppliers what their own recovery plans assume.

Bottom line

Boston Scientific contained its attack within weeks and still lost an estimated $150m of quarterly sales, saw gross margin fall three points and expects a further hit next quarter. UK organisations should model the full cost honestly, segment their networks, rehearse running without core systems and test their insurance before an incident does it for them.

Sources

Related Posts