Boston Scientific (NYSE: BSX) told the U.S. Securities and Exchange Commission on Monday that the cyberattack it disclosed in August is material. The clearest signal is the form itself: August's report arrived under Item 8.01, the catch-all used for other events, while Monday's arrived under Item 1.05, the item reserved for material cybersecurity incidents. That is not a change of wording. It is a formal determination by the company, and the SEC attaches a clock to it.
The distinction matters because of when that clock starts. Under the SEC's cybersecurity disclosure rules, a company must file under Item 1.05 within four business days of deciding an incident is material — not within four days of discovering it. A company that cannot yet tell is permitted to disclose under Item 8.01 first and upgrade later. Boston Scientific did exactly that.
The company identified the intrusion on Aug. 25. Its filing the following day stated that it "has not yet determined whether the incident is reasonably likely to have a material impact on the Company." This week's report is dated Sept. 7. Roughly two weeks passed between finding the breach and concluding it would bend the year's numbers.
The upgrade path is worth understanding, because it is where the information is. Filing under the catch-all item first is a common and entirely legitimate move. It lets a company alert the market to a disruption it can see without asserting a financial conclusion it cannot yet support. What it also does is leave a dated record of when the company stopped hedging.
That record is the part a wire summary tends to compress. The headline conclusion — guidance will not be met — is the same either way. The filing adds something the press release does not: the company's own timestamp on the moment its assessment changed, and the regulatory item it chose to sit under.
What the filing actually says
The Item 1.05 report states that the incident is "likely to have a material impact on the Company's results of operations for the third quarter and full year 2026." It adds that Boston Scientific is "unlikely to meet the net sales growth and adjusted EPS guidance ranges" for both periods. The company has not replaced those ranges with new ones. For now the market is working without a published target.
Those ranges were set in late July, in the second-quarter earnings release filed with the SEC:
- Q3 2026: reported net sales growth of about 3% to 5%; adjusted EPS of $0.80 to $0.82
- Full-year 2026: reported net sales growth of about 5.5% to 6.5%; organic growth (sales stripped of currency swings and acquisitions) of 5% to 6%; adjusted EPS of $3.28 to $3.32
Adjusted EPS strips out items management treats as one-off, such as acquisition and restructuring charges. Organic growth strips out the currency and deal effects. Both are the figures analysts model and the figures the company steers by. Losing them in the middle of a quarter leaves the market without an anchor until the next report lands.
Why It Matters
Strip away the legal machinery and one thing is left. A company that makes implantable heart devices lost the ability to ship them for part of a quarter, and it took roughly two weeks to conclude the damage would reach its numbers.
That is the observation worth holding onto. Cyberattacks on manufacturers are usually described in the language of data — records exposed, systems locked. This one reads better as a logistics event. The binding constraint was physical: goods that existed but could not be released.
The form choice matters for a second reason. It puts a dated marker on the company's own change of mind, which is something a press release alone would not have left behind.
Sizing the window
The filings allow a rough sizing of what sat inside the disruption. Boston Scientific does not print a standalone third-quarter figure in its full-year release, but it can be derived by subtraction:
| 2025 net sales | Amount |
|---|---|
| Full year | $20.074B |
| Q1 | $4.663B |
| Q2 | $5.061B |
| Q4 | $5.286B |
| Q3 (derived) | ~$5.064B |
Grow that by the 4% midpoint of the guidance range, and the third quarter of 2026 was tracking toward roughly $5.27 billion. That is the base the attack landed on. Nothing in the filing suggests demand changed. What changed was the ability to ship.
The quarter runs 92 days. Boston Scientific found the intrusion on Aug. 25. That leaves 36 days after the event — about 39% of the period.
On a straight-line basis, roughly $2.06 billion of guided third-quarter revenue sits inside that window. That figure is an exposure window, not a loss. It is revenue that had to be produced, sterilized, packed and shipped while systems were down — not revenue that vanished. The company says its major distribution centers are now "processing and shipping customer orders at or above normal operating levels," that all sterilization facilities are running, and that manufacturing has resumed at most sites globally. It expects to recover "some portion" of the impacted revenue as backlogs clear.
The same arithmetic applied to profit is tidier. The guided third quarter is worth roughly a quarter of full-year adjusted EPS. Apply the same 39% window, and close to a tenth of the year's adjusted profit sits on the wrong side of Aug. 25. That is the outer bound of the damage, before any recovery.
Why sterilization is the line that matters
The sterilization detail is easy to skim past and should not be. A medical device is not shippable until it has been sterilized, and that step is a licensed, validated process. It cannot simply be moved to another building when systems go down. It sits between the factory and the distribution centre, and it is the narrowest point in the chain.
When that step stops, finished goods accumulate in a state where they physically exist but cannot be sold. This is why the company's restoration sequence reads the way it does — distribution first, then sterilization, then manufacturing. Recovery in a device business is not a switch. It is a queue that has to drain in order.
The second-half problem underneath
There is a structural issue sitting beneath the outage. Boston Scientific earned adjusted EPS of $0.80 in the first quarter and $0.86 in the second. That is $1.66 across the half, against a full-year range whose midpoint is $3.30. The back half was guided at roughly the same level as the front half, at the midpoint fractionally below it, not to beat it.
That is worth pausing on. The 2026 plan did not lean on a second-half acceleration; it leaned on the second half simply holding the line. A guide built that way carries no slack. When a disruption lands in the very half that was supposed to hold steady, there is no stronger quarter waiting behind it to absorb the damage.
The medtech precedent
Medtech has a recent template for this. LineVest has not covered Boston Scientific before, but it did cover Stryker (NYSE: SYK) on July 31, 2026, after a cyberattack disrupted that company's own first quarter. In that case the damage proved to be a timing effect: first-half organic sales growth came in at 5.0%, held down by the opening quarter, while the second quarter alone rebounded to 9.0%.
The comparison cuts both ways. Stryker recovered its pace within a single quarter and still narrowed its full-year outlook rather than abandoning it — LineVest reported at the time that Stryker's adjusted EPS floor actually rose. Boston Scientific has gone further than Stryker did. It has told the market its ranges will not hold, and has not yet offered replacements. Whether that reflects a worse incident or a more cautious disclosure posture is not something the filing answers.
One operational detail from the company's own update belongs alongside the financial ones. Boston Scientific makes pacemakers, defibrillators and stents. It says remote monitoring activations for cardiac devices were disrupted during the outage and have since been restored, and that product quality analysis to date indicates no impairment to product function. CrowdStrike (NASDAQ: CRWD), a U.S. cybersecurity firm, remains engaged on the investigation alongside other outside specialists.
What the market had already priced
The stock was marked down well before Monday's filing. Shares closed at $47.80 on Sept. 4, according to StockAnalysis.com. That sits near the bottom of a range running from $42.20 to $109.50 over the past year.
At that level the company is worth roughly $70.7 billion (based on approximately 1.48 billion diluted shares). Reuters reported the shares fell about 4.5% in premarket trading after the disclosure. That move is modest next to the range above it. Much of the operational story had been public since August, and what Monday's filing added was the formal label rather than new facts.
What would make this reading wrong
Treating this as a timing problem rather than a demand problem has a specific failure mode. Boston Scientific's products go into scheduled procedures. If hospitals rebooked those procedures around a competitor's device while shipments were down, the backlog does not convert — it disappears. Physician preference in cardiology and endoscopy is sticky in both directions, which cuts against a fast rebound as easily as it cuts for one.
The test is straightforward. If the fourth quarter shows the backlog clearing on schedule, the outage cost time. If it does not, the outage cost share.
The date that settles it
Boston Scientific reports third-quarter results on Oct. 28. Three things in that release will answer more than this filing did. The size of the revenue shortfall against the 3% to 5% range it now says is out of reach will show the gross damage. Whether management reinstates a full-year figure at all will show how much visibility it believes it has. And the backlog commentary will show whether the deferred orders are still on the books.
Until then, the most concrete fact remains the one in the form header. The company moved its own disclosure from the item you use when you do not know to the item you use when you do.
Segment-level exposure across Cardiovascular and MedSurg, the four-quarter revenue and margin trend table, a peer comparison against Stryker, Medtronic and Abbott through their own disruption quarters, and the cash-flow bridge are in the full report.
Sources
- SEC 8-K Item 1.05 Filing, Sept. 7, 2026
- SEC 8-K Item 8.01 Filing, Aug. 26, 2026
- BSX Q2 2026 Earnings Release (SEC)
- BSX Q4 2025 / Full-Year Earnings (SEC)
- Boston Scientific Cybersecurity Update
- Yahoo Finance: BSX Cyberattack Story
- SEC Cybersecurity Disclosure Rules (Morrison & Foerster)
Disclaimer: This article is journalism, not investment advice. LineVest is not a registered investment adviser and does not make buy, sell or hold recommendations. All figures are drawn from SEC filings, company statements and cited third-party sources as of Sept. 8, 2026. Readers should conduct their own research and consult a licensed professional before making any financial decision.
