Update on recent cybersecurity incident

Final CrowdStrike Investigation Summary Regarding Boston Scientific’s August 25 Cybersecurity Incident  

Since identifying the cybersecurity incident on August 25, Boston Scientific has worked closely with CrowdStrike and other third-party cybersecurity experts to contain the threat, conduct a comprehensive forensic investigation and safely restore operations. 

Today, we are sharing CrowdStrike's investigation summary, which is available in the attachment below. 

Investigation and findings 

CrowdStrike completed its independent investigation and determined that the threat actor gained access to an external-facing network device and then to a limited portion of Boston Scientific’s on-premises IT environment.   

The investigation found no evidence of ongoing threat actor activity following Boston Scientific's containment measures implemented on August 25, 2026.  

CrowdStrike found no evidence of compromise within Microsoft Office 365 applications (including email), other cloud-based applications or business systems related to manufacturing maintenance, product and software development, medical device maintenance, human resources and employee benefits systems or Boston Scientific’s supervisory control and data acquisition (SCADA) environments.  

CrowdStrike also found no evidence that the threat actor accessed, staged or exfiltrated data from those systems and applications, including customer or patient data. 

Supporting previous assessments, based on the investigation and containment measures completed, customers and partners may safely continue normal business activities and system connections with Boston Scientific. 

Our continuing commitment 

We are grateful for your patience and partnership throughout our response and recovery. Again, please refer to the CrowdStrike report for additional information about the forensic investigation, its scope and its conclusions. 

CrowdStrike investigation summary