At two in the afternoon on Tuesday, Boston Scientific sent the day shift home from its Cork plant with full pay. No fire, no failed machine. What had stopped was the network.
The company filed a Form 8-K the next morning. I went and read it, because by then the headlines were already calling this a cyberattack and the filing is the only account Boston Scientific has signed its name to. It says the company identified a cybersecurity incident on August 25 affecting certain of its information technology systems, and that the incident "has resulted in a global disruption to the Company's operations." Then comes the line a founder should stop on. The disruptions include "the ability to process and ship customer orders."
What the filing says, and what it leaves out
Four things in that document are worth having straight. The incident was identified on August 25. Order processing and shipping are named. The timeline for full restoration is "not yet known." And the company has "not yet determined whether the incident is reasonably likely to have a material impact."
Then there is what the filing leaves out, which is worth as much as what it says. Nothing about implanted or in-use devices. Nothing about patient data. When I am checking a story like this, a gap in the primary document is not something to route around, it is part of the finding. An open investigation is no clean bill of health, and Boston Scientific may say more next week. But on day two, with counsel reviewing every clause, what the company put its name to was a shipping problem.
Why Item 8.01 is the ordinary route
Boston Scientific filed under Item 8.01, "Other Events," and it is tempting to read that as a dodge. It isn't. The SEC's cybersecurity disclosure rules took effect in December 2023, and Item 1.05 is reserved for incidents a company has determined are material. In May 2024 the SEC's Division of Corporation Finance told registrants that where materiality has not been determined, they should disclose under a different item, and file an Item 1.05 within four business days if they later conclude the incident is material.
Practice followed the guidance. Debevoise, which has tracked every one of these filings since the rules took effect, counted 29 issuers filing under Item 1.05 and 50 under Item 8.01 as of May 21 this year, with only five doing both. Item 8.01 is the ordinary front door. Read the item number for signal and you are reading the wrong line.
Why a factory stops when the network does
Boston Scientific employs roughly 59,000 people, more than 7,000 of them across three Irish plants in Galway, Clonmel and Cork. The Cork day shift went home at two with full pay. Evening contract staff were paid four hours. Galway and Clonmel staff were offered unpaid or annual leave, and by Wednesday the instruction was to work from home wherever the work allowed it.
None of that happens because a robot stopped moving. In a regulated plant, the record is the permission. A device history record, a lot release, a serial number tied to a batch: those are what let finished goods leave the building. Product can be sitting on a shelf, complete and correct, and still be unshippable, because nobody can demonstrate it was released. The quality system is not a filing cabinet you keep for the auditors. It is a gate on revenue, and it runs on the same network as the email.
So the question worth carrying back to your own company is narrower than "do we have a firewall." If the ERP is dark on Monday morning, can you release a lot? Is there a paper path, has anyone walked it, and does your own quality manual permit it? The third one is where it bites. A continuity plan written by operations does not override a quality procedure that requires an electronic signature on release.
Platform dependency is expensive money you never raised and can't negotiate, and I usually aim that at hyperscalers; this week it points inward. You don't own a business you can't switch back on yourself, and the test doesn't care whether the switch sits in somebody else's data center or your own server room. Boston Scientific will restore its systems and ship its backlog, and a company with eight months of runway and one ERP instance doesn't get that assumption.
From Dave’s video library
Dave reads the study behind a headline about AI outperforming lawyers, and finds the model helped grade its own work.
I’m here to help you scale.
Work With DavePrefer a smaller first step? Book a $500 one-hour working session →
Dave Saunders is the founder of Base Reality Group and a Fractional CPO for product companies. He was a founder and operator at Galen Robotics, where the surgical-robotics platform earned FDA De Novo authorization in 2023, and he managed a 35-patent portfolio licensed from Johns Hopkins. He wrote Founders Who Finish and publishes The Build. More about Dave →