Quick Answer
Boston Scientific’s cybersecurity incident is disrupting activation of new remote-monitoring communicators for newly implanted cardiac devices, while existing remote monitoring remains operational. The company says devices not connected to its network have no known impact, but new setup is delayed and order fulfillment remains constrained. Patients with a newly implanted device should contact their care team for monitoring instructions rather than assume data is transmitting.
Key Takeaways
- Boston Scientific identified the cybersecurity incident on August 25, 2026.
- Existing remote monitoring for implanted cardiac rhythm-management devices remains unaffected.
- New remote-monitoring communicators cannot currently be activated for most newly implanted cardiac devices.
- New insertable cardiac monitors still record episodes, but patients cannot pair them with the monitoring phone app during the outage.
- Electronic orders can be submitted through EDI and GHX, but Boston Scientific cannot yet process or ship those orders.
What happened in the Boston Scientific cyberattack?
Boston Scientific identified a cybersecurity incident on August 25, 2026, that caused a network outage and disrupted company operations. The company later said affected information systems and business applications support the processing and shipping of customer orders, which means the event has operational consequences beyond internal office systems.
Boston Scientific had not provided a timeline for full restoration in its August 26 filing with the Securities and Exchange Commission. Boston Scientific’s August 26 Form 8-K confirms that the outage affected systems used to process and ship customer orders. The lack of a restoration date matters because hospitals, clinics, and patients cannot rely on a fixed date for normal fulfillment or new device-monitoring setup.
Boston Scientific described the event as a cybersecurity incident rather than publicly identifying the method of intrusion, the responsible party, or any data exposure. The available information therefore supports a conclusion about service disruption, not a conclusion about the incident’s technical cause. Patients and providers should avoid treating unverified claims about stolen data or device compromise as established facts.
The practical concern is continuity of care and supply operations. Patients with scheduled implants, recently implanted devices, or pending equipment should ask their cardiac care team whether the outage changes their appointment, activation, or follow-up plan.
Which heart-device monitoring services are affected?
Boston Scientific says existing remote monitoring for implantable cardiac rhythm-management devices is not affected by the outage. The company’s August 27 update states that the function of implanted cardiac rhythm-management devices and existing remote monitoring remain available, which is the most important distinction for patients who already have an active monitoring connection.
New remote-monitoring setup is affected because newly implanted cardiac devices require an activation process that currently cannot be completed for most device types. Boston Scientific said on August 28 that new remote-monitoring communicators for newly implanted cardiac devices, except insertable cardiac monitors, cannot be activated. Available device data therefore does not transmit to remote patient-management systems until the activation service is restored.
Boston Scientific’s patient notice draws a clear line between device function and network-enabled monitoring setup. A device that is already implanted does not become nonfunctional simply because a new communicator cannot be activated. At the same time, delayed remote transmission can change how a clinic receives device information, so patients should follow instructions from their electrophysiology or cardiology team.
| Patient or service situation | Current status described by Boston Scientific | Practical response |
|---|---|---|
| Existing implanted cardiac device with active remote monitoring | Existing remote monitoring is not affected. | Continue following the normal care plan unless the clinic provides different instructions. |
| Newly implanted cardiac device using a communicator | New communicator activation is unavailable, and device data cannot transmit until activation returns. | Contact the implanting clinic for interim monitoring instructions. |
| Newly implanted insertable cardiac monitor | Phone-app pairing is unavailable, but the monitor continues recording episodes. | Ask the clinic how and when recorded episodes will be reviewed in person. |
| Hospital or clinic awaiting products | Orders can be queued electronically but cannot yet be processed or shipped. | Confirm inventory and scheduling directly with Boston Scientific and local suppliers. |
What does the outage mean for newly implanted cardiac devices?
Newly implanted cardiac devices can continue to operate, but some patients cannot complete the remote-monitoring activation process during the Boston Scientific outage. The company says that remote-monitoring communicators for newly implanted cardiac devices cannot currently be activated, apart from the separate process used for insertable cardiac monitors.
Remote monitoring generally depends on a device, a communicator or phone connection, and a patient-management system that receives the transmitted information. When activation is unavailable, the limitation is the connection to the monitoring service rather than an announced failure of the implanted device itself. That distinction matters because a patient may feel well and still not have the expected remote data transmission available to the clinic.
Boston Scientific says there is no known impact to devices that are not connected to its network. The company also says it has no evidence that the affected environment increased cybersecurity risk to hospital networks through use of its devices. Those statements address the currently known scope, but they do not replace an individual patient’s clinical instructions after a new implant.
Patients should contact the implanting clinic if they were told to set up monitoring after a recent procedure and cannot complete the process. Seek urgent medical care for symptoms that a clinician has instructed you to treat as urgent, rather than waiting for a remote-monitoring issue to be resolved.
How are insertable cardiac monitors affected by the outage?
Newly implanted insertable cardiac monitors cannot be paired with Boston Scientific’s remote-monitoring phone app during the outage, but the monitors continue to record episodes. Boston Scientific says the recorded episodes can be sent through an in-person interrogation using the Clinic Assistant app, which provides a temporary clinical path for retrieving stored information.
An insertable cardiac monitor is a small implanted device that records heart-rhythm information over time. The immediate limitation is that patients cannot establish the usual phone-app connection for new devices, so information that would normally move through remote monitoring may need to be collected during an in-person clinic visit.
Boston Scientific’s update does not say that existing paired insertable cardiac monitors have stopped recording or transmitting. The company’s specific warning applies to pairing newly implanted monitors during the outage. Patients should not attempt repeated setup changes unless their clinic directs them to do so, because the underlying service limitation cannot be fixed through normal phone troubleshooting.
The safest next step is to call the cardiac clinic that implanted the monitor and ask whether an in-person interrogation is needed. A clinic can determine the appropriate timing based on the reason for monitoring, the patient’s symptoms, and the care plan already in place.
Are existing Boston Scientific devices and hospital networks at risk?
Boston Scientific says there is no known impact to devices not connected to its network and no evidence that the affected environment increased cybersecurity risk to hospital networks through use of its devices. The company’s August 28 customer and patient update is the clearest available statement on device and hospital-network risk during the incident.
Boston Scientific’s incident notice also says existing remote monitoring for implantable cardiac rhythm-management devices is not affected. This is reassuring for patients with already active monitoring, but it remains a statement about the company’s known conditions at the time of the update rather than a guarantee that every care workflow is unchanged.
Medical-device cybersecurity incidents can create risk through disrupted services even when the implanted hardware itself continues functioning. A monitoring delay, unavailable activation workflow, or delayed shipment can affect appointments and clinical coordination. The company’s notice does not establish that patient devices were compromised or that hospital networks were breached through a Boston Scientific device.
Patients should rely on clinical communications from their hospital or device clinic, not social-media posts or unsolicited calls claiming to provide device support. Account and device-support scams often take advantage of public incidents, much as consumers can face follow-on risks after a health care data breach.
How is the cyberattack affecting orders and manufacturing?
Boston Scientific says the outage is affecting its ability to manufacture products and to process and ship customer orders. The company disclosed that operational impact on August 27, expanding the earlier description of systems used for order processing and shipping.
Electronic orders can still be accepted through EDI and GHX, according to Boston Scientific’s August 28 update. EDI, or electronic data interchange, is a business-to-business ordering method, while GHX provides supply-chain services used in health care. The important limitation is that Boston Scientific cannot yet process or ship the submitted orders, so those orders are queued for future fulfillment.
The outage can therefore affect hospitals and clinics even when an individual patient’s implanted device is functioning normally. A provider may need to evaluate current inventory, scheduled procedures, and alternatives for items that have not shipped. Patients should not assume a procedure is canceled, but patients with an upcoming implant should confirm the appointment status directly with the provider.
The broader supply-chain effect illustrates why cybersecurity incidents can become patient-care issues without becoming direct device failures. Security teams and health care organizations increasingly have to protect both clinical systems and the business applications that keep equipment moving. Similar operational consequences can follow flaws that require organizations to apply critical security updates before an attacker can disrupt connected systems.
What should patients and providers do while services are restored?
Patients with recently implanted Boston Scientific cardiac devices should contact their care team if new remote monitoring has not activated. Boston Scientific has not given a full-restoration timeline, so a clinic is the appropriate source for individual instructions about monitoring, follow-up visits, and any need for in-person device interrogation.
- Confirm whether the implanted device already has active remote monitoring before assuming that monitoring is interrupted.
- Contact the implanting clinic if a newly implanted device communicator or phone app cannot be activated.
- Ask whether the clinic needs an in-person visit to retrieve data from a newly implanted insertable cardiac monitor.
- Verify upcoming procedures and equipment availability with the provider if an implant or replacement is scheduled.
- Follow emergency instructions from the care team and seek urgent medical attention for serious symptoms instead of waiting for a remote connection.
Providers should use Boston Scientific’s available electronic ordering channels where appropriate, while recognizing that submitted orders remain queued until processing and shipping resume. Hospitals should also follow their established downtime procedures and communicate clearly with affected patients about whether monitoring activation or procedures have changed.
Patients should be cautious about unexpected emails, texts, or phone calls that cite the Boston Scientific incident and request account details, payment information, or device identifiers. Public breaches and outages can create useful pretexts for fraud, which is why consumers should use the official contact information provided by their clinic or manufacturer. Basic steps that reduce online tracking exposure can improve privacy generally, but they do not resolve a medical-monitoring activation issue.
Why does the Boston Scientific incident matter beyond the company?
Boston Scientific’s incident matters because network-dependent health care services can affect patient monitoring, product availability, and clinical operations at the same time. The company says existing remote monitoring remains available, but the disruption to activation and order fulfillment shows how a business-system outage can reach patient-facing workflows.
Boston Scientific shares fell about 4% in morning trading after the disclosure, reflecting the market’s response to the operational disruption. Reuters reported the market move after the company disclosed the incident. The share-price reaction does not determine patient risk, but it reflects concern about the scale and duration of the business interruption.
The most important perspective is that the available public information does not describe a loss of function for existing implanted cardiac rhythm-management devices or a confirmed increase in hospital-network risk. The confirmed impact is more specific: newly activated monitoring services are delayed, new insertable cardiac monitors cannot pair with the phone app, and order processing and shipping remain constrained.
Patients should focus on the status of their own monitoring plan, while providers should focus on local inventory and care continuity. Boston Scientific’s updates may change as systems are restored, so current instructions from the patient’s care team remain more useful than general assumptions about the outage.
FAQ
Is Boston Scientific remote monitoring down?
Boston Scientific says existing remote monitoring for implantable cardiac rhythm-management devices is not affected. New remote-monitoring communicators for newly implanted devices cannot currently be activated, so new data transmission may be delayed.
Can a newly implanted Boston Scientific cardiac device still work?
Boston Scientific says implanted cardiac rhythm-management device function is not affected by the outage. The current problem involves activation of new remote-monitoring services, not an announced loss of implanted-device function.
What happens to a new insertable cardiac monitor during the outage?
Newly implanted insertable cardiac monitors continue recording episodes, according to Boston Scientific. Patients cannot pair the monitor with the remote-monitoring phone app during the outage, but a clinic can retrieve recorded episodes through an in-person interrogation.
Can hospitals still order Boston Scientific products?
Boston Scientific can accept electronic orders through EDI and GHX, but it cannot yet process or ship them. Submitted orders are queued for fulfillment after the company restores those operations.
Should patients contact their doctor about the Boston Scientific cyberattack?
Patients with a newly implanted device or an unsuccessful remote-monitoring setup should contact their cardiac care team for specific instructions. Patients should seek urgent medical care for serious symptoms rather than waiting for remote monitoring to become available.