Boston Scientific is the latest major life sciences company to disclose a cybersecurity incident in 2026. Examined alongside incidents at Stryker, West Pharmaceutical Services, Medtronic, Novo Nordisk, iRhythm and Amgen, a broader risk pattern begins to emerge.
Introduction
On August 26, 2026, Boston Scientific disclosed that a cybersecurity incident identified the previous day had caused a global disruption to its operations. According to the company's Form 8-K, the incident affected access to information systems and business applications, including systems used to process and ship customer orders. At the time of the disclosure, the company said the timeline for full restoration was not yet known and that the operational and financial impacts were still being assessed.
Those facts are significant on their own. But Boston Scientific is not an isolated case. During 2026, several major life sciences and medical technology companies have publicly disclosed cyber incidents involving materially different outcomes: global operational disruption, manufacturing and distribution impacts, system encryption, data exfiltration, exposure of clinical or patient information, and compromises involving third-party-hosted environments.
There is no public evidence that these incidents share a common attacker, vulnerability, or root cause. Nor does this series of incidents by itself establish a statistically measurable increase in attacks across the industry. What the disclosures do provide, however, is a useful set of real-world examples showing how cyber risk can move through a life sciences organization and why the business consequences can differ dramatically from one incident to another.
This analysis is based on public company disclosures available as of August 26, 2026. Several investigations remain ongoing, and additional facts may emerge.
Boston Scientific: The latest operational disruption
Boston Scientific reported that the August 25 incident resulted in a network outage and global operational disruption. The company activated incident response procedures and engaged third-party cybersecurity experts to assist with investigation and containment. Its public disclosure specifically identified an impact to the ability to process and ship customer orders.
As of August 26, Boston Scientific had not publicly disclosed the attack method, the identity of the attacker, whether ransomware was involved, or whether data had been accessed or stolen. The company also had not yet determined whether the incident was reasonably likely to have a material impact.
That distinction matters. The confirmed issue at this stage is not data theft. It is loss of availability affecting business operations. For life sciences organizations, that is an important reminder that a cyber incident does not need to expose patient or proprietary information to create significant business risk.
Cyber risk in life sciences includes both the confidentiality of critical information and the availability of the systems required to manufacture, distribute, sell and support products.
The 2026 life sciences cyber pattern
| Company | Publicly disclosed incident | Confirmed business impact |
|---|---|---|
| Boston Scientific August 2026 | Cybersecurity incident affecting certain IT systems. | Global operational disruption; access to business applications was limited, including the ability to process and ship customer orders. Full restoration timing was not yet known when disclosed. |
| Stryker March 2026 | Cybersecurity incident affecting IT systems and causing disruption to the company's corporate network environment. | Order processing, manufacturing and shipping were disrupted. Stryker later determined that the incident had a material impact on operations and its first-quarter financial results. Its manufacturing, ordering and distribution systems were subsequently restored. |
| West Pharmaceutical Services May 2026 | Material cybersecurity attack involving data exfiltration and encryption of certain systems. | Business operations were temporarily disrupted globally. Manufacturing, receiving and shipping processes were restarted as systems were restored. |
| Medtronic April 2026 | Unauthorized party accessed data in certain corporate IT systems. | Medtronic reported no identified impact to products, patient safety, manufacturing or distribution. The company also stated that its corporate IT, product, and manufacturing/distribution networks are separate. |
| Novo Nordisk June 2026 | Unauthorized access to a limited number of internal IT systems; certain non-public data, including personal data, was copied externally. | Novo Nordisk reported that its core business operations remained operational. The company later confirmed that a limited amount of information related to participants in some clinical trials was affected. |
| iRhythm June 2026 | Unauthorized activity involving data maintained in third-party-hosted business applications. The company confirmed data exfiltration and said the affected data was obtained through social engineering. | iRhythm reported no identified impact to products, clinical or medical-device systems, patient safety, manufacturing or distribution. |
| Amgen July 2026 | Unauthorized activity involving data stored in cloud environments hosted by third-party cloud service providers. Amgen confirmed exfiltration of proprietary data, patient protected health information and other information. | Amgen reported no identified impact to products, manufacturing operations or its ability to meet patient needs. |
The value of comparing these incidents is not that they are technically identical. They clearly are not. The value is that they demonstrate several different paths from a cyber event to business impact.
Pattern 1: Similar cyber events can produce very different business outcomes
The 2026 disclosures divide broadly into two categories of consequence.
At Stryker, West Pharmaceutical Services and Boston Scientific, the incidents reached systems or processes that support business operations. Stryker reported disruption to order processing, manufacturing and shipping. West reported temporary global operational disruption while manufacturing, receiving and shipping functions were restored. Boston Scientific reported global disruption affecting, among other functions, customer-order processing and shipment.
Other incidents produced a different outcome. Novo Nordisk confirmed that data was copied externally but reported that core business operations remained operational. Medtronic disclosed unauthorized access to corporate IT data but reported no identified impact to manufacturing, distribution, products or patient safety. iRhythm and Amgen likewise disclosed data exfiltration while reporting no identified impact to manufacturing or product operations.
These examples demonstrate why cyber risk cannot be evaluated solely by asking whether data was stolen. A confidentiality event may create privacy, regulatory, intellectual-property or reputational consequences. An availability event may interfere directly with order fulfillment, manufacturing or distribution. Some incidents can create both.
Cyber risk assessments should explicitly evaluate both data-loss scenarios and the operational consequences of losing access to critical technology.
Pattern 2: Architecture becomes visible when an incident occurs
Medtronic's April disclosure provides one of the clearest examples of architectural separation in the public record. The company stated that the networks supporting corporate IT, products, and manufacturing and distribution operations are separate. It also reported that the incident had not been identified as affecting its products, patient safety, manufacturing or distribution operations.
That disclosure should not be interpreted as proof that segmentation alone prevented a broader impact; Medtronic has not publicly established that causal relationship. It does, however, illustrate why architectural separation and segmentation are central elements of cyber resilience. When systems supporting corporate functions, connected products, laboratories, manufacturing and distribution are tightly interconnected, the potential blast radius of an incident can expand.
The operational disruptions reported by Stryker, West and Boston Scientific reinforce the importance of understanding those dependencies. During an incident, leadership needs to know which business processes depend on which systems, where trust relationships exist, and which environments can continue functioning when another environment is isolated or unavailable.
Network and system architecture should be evaluated not only for security control effectiveness, but also for how effectively it can limit operational blast radius during a cyber incident.
Pattern 3: The enterprise boundary extends into cloud and third-party environments
Two 2026 disclosures make this point particularly clear.
iRhythm reported that affected information was maintained in third-party-hosted business applications and that the data was obtained through social engineering. Amgen reported unauthorized activity involving data stored in cloud environments hosted by third-party cloud service providers and subsequently confirmed that proprietary data, patient protected health information and other information had been exfiltrated.
For life sciences companies, this is a critical distinction. Clinical, commercial, quality, research and administrative processes increasingly depend on SaaS platforms, cloud environments and specialized external providers. Sensitive information can therefore be exposed without a traditional compromise of the organization's internal network.
The security boundary has effectively moved. Identity controls, privileged access, cloud configuration, data governance, third-party oversight, logging and monitoring must follow the data and the business process rather than stop at the corporate perimeter.
Third-party and cloud environments should be treated as part of the operational security architecture, not as external systems evaluated only during procurement.
Pattern 4: The assets at risk extend beyond PHI
Privacy remains a major concern, but the 2026 disclosures also show that the information at risk can be much broader.
Novo Nordisk confirmed that non-public data was copied externally and that a limited amount of information related to patients participating in some clinical trials was affected. Amgen confirmed exfiltration of proprietary data in addition to patient protected health information and stated that its investigation was evaluating potential exposure involving confidential business information, intellectual property, and research and development information.
This matters because life sciences organizations create enterprise value through more than patient information. Clinical data, research and development information, intellectual property, manufacturing knowledge, regulatory information, commercial strategy and other proprietary assets can be just as consequential to the business.
A mature cyber risk program therefore needs to distinguish between information that is regulated, information that is operationally critical, and information that is strategically valuable. Those categories overlap, but they are not identical.
Data protection priorities should reflect business value and operational importance as well as privacy and regulatory classification.
The broader lesson: Cyber resilience is business resilience
Taken together, these incidents suggest a broader conclusion. Preventing unauthorized access remains essential, but prevention alone is not a sufficient resilience strategy.
Organizations also need to assume that some attacks will succeed and understand what happens next. Which systems can be isolated without stopping critical operations? Which business processes have tested alternatives? How quickly can manufacturing, distribution, clinical, quality and commercial functions recover? Can investigators determine what data was accessed? Can leadership make materiality, regulatory, customer and patient-impact decisions while the investigation is still evolving?
Those questions span cybersecurity, infrastructure, business continuity, disaster recovery, quality, privacy, legal, regulatory affairs and executive management. That is precisely why major cyber incidents cannot be treated solely as IT events.
The contrast across the 2026 incidents is instructive. Some organizations experienced significant data exposure while maintaining core operations. Others experienced disruptions that reached manufacturing, distribution or order fulfillment. The difference in outcomes reinforces the need to manage cybersecurity as an enterprise resilience discipline that considers architecture, data, third parties and operational dependencies together.
Conclusion
Boston Scientific's August incident is still under investigation, and it would be premature to speculate about its cause or ultimate impact. What is already clear is that the incident joins a series of 2026 life sciences cyber events that illustrate the breadth of modern cyber risk.
For executives, the most useful lesson is not that every organization faces the same attack. It is that a cybersecurity incident can affect very different parts of enterprise value: sensitive information, intellectual property, clinical data, manufacturing, distribution, customer fulfillment and ultimately the organization's ability to serve patients and customers.
Cybersecurity programs should therefore be evaluated against a broader standard than whether an intrusion can be prevented. The more important resilience question is whether the organization can contain an incident, limit its blast radius, understand what was affected, maintain critical operations and recover in a controlled manner when prevention fails.
Related resource: Building a trusted partner ecosystem
For teams reviewing how cyber risk extends across vendors, cloud platforms, outsourcing partners and operational dependencies, USDM's Life Sciences Cybersecurity: Building a Trusted Partner Ecosystem white paper outlines a practical model for continuous third-party oversight and inspection-ready vendor risk evidence.