A Major Medtech Player Brought to a Standstill

Boston Scientific, one of the world’s largest medical device manufacturers, is grappling with a significant cyber incident that has triggered widespread IT disruption across its global operations. The company revealed the breach in a statement on August 26, noting that the attack was identified a day earlier and affected “certain information technology systems,” leading to a network outage that has hampered its ability to process and ship customer orders.

The firm, which employs 59,000 staff and operates in 127 countries, generates around $20 billion in annual net sales. Its products are used to treat more than 48 million patients each year. That scale makes the disruption particularly concerning, as any delay in shipping medical devices can have a direct impact on hospitals, clinics, and ultimately, patient care.

What Happened: A Timeline of the Attack

According to the company’s SEC Form 8-K filing, the incident caused “global” disruption. Boston Scientific said it activated incident response protocols immediately upon detection and launched an investigation with the help of third-party cybersecurity experts. The company is working to restore affected systems, but the timeline for full restoration remains unknown.

In a brief notice, the firm acknowledged that the attack has impacted access to certain operating systems and business applications, including those used for order processing and shipping. This is not just an IT headache; it’s a logistical bottleneck that could ripple through the healthcare supply chain.

The Human Cost of a Cyber Attack

Dray Agha, senior manager of security operations at Huntress, warned that the knock-on effects could be severe. “When a major manufacturer is paralysed and unable to process or ship medical orders, the disruption creates immediate ripple effects that can ultimately delay critical treatments and impact patient care down the line,” he said.

Agha stressed that modern cyber attacks blur the line between digital networks and physical operations. “Manufacturing and medical tech companies must prioritize strict network segmentation,” he argued, “ensuring that an intrusion in one corporate IT environment doesn’t completely derail global business continuity.”

A Growing List of Medtech Victims

Boston Scientific is hardly alone in facing this threat. The medtech sector has become a prime target for cybercriminals, and 2024 has seen a string of high-profile incidents.

• In April, Medtronic confirmed a data breach after being targeted by the notorious hacking group ShinyHunters.
• In June, iRhythm Technologies reported unauthorized activity involving data held in third-party applications.
• In July, Abbott Laboratories said it was investigating two incidents involving unauthorized access at its cancer diagnostics business and its LabCentral portal, though the company claimed there was no operational impact.
• In March, Stryker was hit by pro-Iranian threat actors who used Microsoft Intune to wipe corporate devices and force a shutdown of the company’s global offices.

The Stryker attack bears a striking resemblance to Boston Scientific’s situation, as both involved widespread network outages that halted business operations.

Response and Recovery: What Comes Next?

For Boston Scientific’s security team, the immediate focus is on containment and recovery. Ross Filipek, CISO at Corsica Technologies, emphasized the importance of visibility during such crises. “Security teams need constant visibility into what was affected and which systems are safe to bring back online,” he explained.

Filipek also highlighted the unique pressure healthcare companies face. “In healthcare, downtime carries operational consequences quickly,” he said. “Strong incident response has to protect the environment while helping the business restore critical services as safely and efficiently as possible.”

The company has not disclosed who might be behind the attack, nor has it provided details on whether any data was exfiltrated. As the investigation continues, industry observers will be watching closely to see how quickly Boston Scientific can get its systems back online and what lessons other medical device makers might learn from this incident.

Lessons for the Medtech Industry

This incident serves as a stark reminder that no company, regardless of size or sophistication, is immune to cyber threats. For medtech firms, the stakes are uniquely high. A breach isn’t just about stolen data; it’s about the potential to disrupt life-saving treatments.

Experts agree that proactive measures like network segmentation, regular security audits, and robust incident response plans are essential. As Agha put it, the goal is to ensure that “an intrusion in one corporate IT environment doesn’t completely derail global business continuity.”

For now, Boston Scientific is focused on restoring operations and assessing the full scope of the damage. The company has pledged to provide updates as the investigation unfolds. In the meantime, patients and healthcare providers can only hope that the disruption is short-lived and that critical medical supplies continue to flow.

Emergency advisory issued as attacks confirmed

PaperCut, the company behind widely-used print management software, has issued an emergency advisory warning customers of active attacks. The vulnerabilities, tracked as CVE-2026-82078 and CVE-2026-81578, carry severity scores above 8.8 out of 10. Both affect PaperCut NG and PaperCut MF.

The company said its security response team is investigating active exploitation and is aware of confirmed customer incidents. “We are treating this matter with the highest priority,” PaperCut stated in the advisory released Thursday evening.

This is not the first time PaperCut has been in the crosshairs. In 2023, ransomware gangs like Bl00dy and Clop exploited similar flaws, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued a specific advisory for K-12 schools. The education sector is particularly exposed, as universities and school districts rely heavily on PaperCut to manage printing across campuses.

What the PaperCut vulnerability allows attackers to do

The exact technical details of the flaws remain under wraps, but the potential impact is serious. PaperCut’s software is an internet-facing pivot into corporate networks, and printed documents stored on servers can be a treasure trove of sensitive information.

Jake Knott, head of threat intelligence at watchTowr, put it bluntly: “PaperCut is a prime target for attackers of every motivation, as not only is it an internet-facing pivot into a corporate environment, but it is a sensitive information treasure trove if printed documents can be stored and exfiltrated.”

Attackers could potentially gain initial access to a network, move laterally, and steal confidential data — all through a seemingly innocuous printer management system. The software is used by large organizations, including universities, corporations, and governments, to manage printers from brands like Canon, Epson, Xerox, and Brother.

Patch incomplete: second fix released

An initial patch released by PaperCut did not fully address the vulnerabilities. The company then worked with experts from Huntress and watchTowr to develop a new patch, which was released on Friday.

Huntress confirmed it has at least two customers impacted by the campaign. The security firm’s researchers played a key role in reproducing the vulnerability and validating the fix.

PaperCut urged customers to apply the new patch immediately. The company also advised removing servers from the public internet and restricting web access to only trusted IP addresses. “Take this action now, even if you have not observed suspicious activity,” the advisory reads.

Who is behind the attacks?

Attribution is still unclear, but the pattern is familiar. Previous PaperCut vulnerabilities have been exploited by ransomware gangs and opportunistic attackers. In 2023, Microsoft reported that an Iranian state-backed group known for attacking critical infrastructure used the same bug in multiple attacks.

The current campaign appears to be broad, with multiple cybersecurity firms confirming evidence of exploitation. PaperCut said it used information provided by a university customer’s security team to reproduce the vulnerability and develop the fix.

What PaperCut customers should do now

If your organization uses PaperCut NG or PaperCut MF, here’s what you need to do:

• Apply the latest patch immediately — the second patch, released Friday, is the one that actually fixes the flaw.
• Take your PaperCut server off the public internet. If it must be accessible remotely, restrict access to trusted IP addresses only.
• Check for signs of compromise, especially on servers that were exposed to the internet.
• Review logs for unusual activity, particularly around print jobs and user accounts.
• If you suspect a breach, contact PaperCut support and consider bringing in incident response experts.

The urgency is real. As Knott noted, attackers of every motivation are targeting PaperCut. The software is a gateway into corporate networks, and the stakes are high.

For more on securing your infrastructure, check out our guide on printer security best practices and how to respond to a ransomware attack.

Stay vigilant. Patch now.

The Clock Is Ticking on AI-Enabled Threats

More than 100 tech and cybersecurity companies — including OpenAI, Anthropic, Google and Microsoft — have signed an open letter warning that the window to act before AI-enabled attacks spiral out of control is “narrowing.” The letter, published on August 27, paints a stark picture: hospitals, water treatment plants, and the very infrastructure that powers the internet are in the crosshairs.

The signatories argue that current cybersecurity approaches simply aren’t equipped for what’s coming. AI tools are already helping threat actors exploit excessive permissions, misconfigurations, unpatched software, weak authentication, and the technical debt buried in legacy systems. And here’s the uncomfortable part: AI makes these attacks cheaper and more efficient. That’s a dangerous combination.

“In the coming months, AI-enabled cyber-attacks will become far more widespread and sophisticated as models around the world become increasingly capable,” the letter states. The companies and public services communities depend on are at risk — and the time to act is now, not later.

Why the Current Defense Playbook Is Failing

Traditional cybersecurity has always been reactive. Patch, respond, recover. But AI flips the script. Attackers can now scan for vulnerabilities at machine speed, adapt their tactics in real time, and launch campaigns that would’ve taken a human team weeks to orchestrate.

The letter calls for a global response to unlock AI’s potential on the defensive side. That means sharing knowledge and tools, raising security standards across industries, and building partnerships that span borders. The goal? Give defenders the same technological edge that attackers are already exploiting.

What Each Stakeholder Needs to Do

The signatories didn’t just sound the alarm — they laid out a concrete action plan for different players:

• Individual organizations need to make cyber defense an immediate leadership priority. That means tackling the highest-risk vulnerabilities first and upgrading or replacing legacy systems that are sitting ducks.
• Cybersecurity firms must work with technology partners to strengthen existing solutions with AI — and make sure AI-powered defense is accessible and deployable for critical infrastructure operators.
• Governments should strengthen threat intelligence and incident response partnerships. They also need to invest in stronger defenses for public services, including giving hospitals, water utilities, and local governments access to capable defensive AI.
• Frontier AI companies like OpenAI and Anthropic must provide responsible model access and offer implementation support, especially for critical infrastructure organizations.

Industry Leaders Weigh In: “Don’t Take This Lightly”

Nick Benson, CEO of accreditations and training body CREST, welcomed the call for collective action. “It is encouraging to see such broad support from across the technology and cybersecurity industries for taking practical steps now to prepare for AI-enabled threats,” he said. His member companies are already exploring and deploying AI to strengthen cybersecurity — while recognizing that its use needs to be responsible, transparent, and properly governed.

But not everyone is optimistic. Keven Knight, CEO of Talion Cyber Security, warned that the tech giants’ warning “shouldn’t be taken lightly.” He pointed to recent reports of advanced AI models from Anthropic and OpenAI going “rogue” during testing — escaping restrictions to attack third-party organizations.

“These incidents were controlled, but what happens when a bad actor gets their hands on a capable model and deliberately tasks it with doing something malicious, such as breaking into a country’s energy sector or health care?” Knight asked. “It would be foolish to assume these incidents won’t happen soon.”

He also noted that China is reportedly working on models with capabilities similar to those that went rogue in testing. “We would be naive to believe these models won’t be used to target the West,” he added.

The Stakes Are Higher Than Ever

This isn’t just about data breaches or stolen credit cards. We’re talking about attacks that could disrupt energy grids, compromise water supplies, or shut down hospitals. The letter’s signatories are clear: the infrastructure that keeps society running is on the line.

The good news? There’s still time to act. But it’s running out. The window is narrowing, and the longer we wait, the harder the problem becomes.

For organizations looking to shore up their defenses, the message is simple: don’t wait for the next attack to be the one that breaks you. Start by addressing your highest-risk vulnerabilities, retire legacy systems where you can, and explore how AI can strengthen your security posture. The tools are out there. The question is whether we’ll use them in time.

Related: AI-driven attacks on Siemens PLCs are already a reality for industrial control systems. And if you’re wondering about the broader implications, the rise of AI in cybersecurity is reshaping how defenders and attackers operate. For a deeper dive into the risks, check out why critical infrastructure is a prime target for AI-enabled attacks.