Boston Scientific: Resilience, Integration and the Next Dollar
Download case PDF (4 pages)Request teacher’s pack
Information cutoff: October 2, 2026, 4:00 p.m. ET
Decision setting: Hypothetical executive committee discussion; no public source says such a meeting or decision was scheduled.
Operations were back; the financial picture was not
On August 25, Boston Scientific identified a cybersecurity incident that disrupted global operations. Manufacturing, order processing and shipping were limited. The company’s first public notice said the scope and financial impact were then unknown. [S1]
By September 9, Boston Scientific reported manufacturing, order fulfillment and shipping fully restored, with products moving at or above normal distribution levels. The company was still reducing backlogs and accelerating deliveries; some customers could continue to experience temporary delays. Restoration of these operating flows did not tell investors how much revenue had been delayed, lost or recovered. [S3]
A September 22 summary of CrowdStrike’s investigation added a bounded technical account. The actor had accessed an external-facing network device and a limited portion of on-premises IT. The investigation identified no ongoing activity after the August 25 containment. It found no evidence of compromise in the specifically listed Microsoft 365, cloud, business or SCADA systems, and no evidence of access, staging or exfiltration from the listed systems and applications, including customer and patient data. The summary did not establish what happened outside the systems it named, the exact exploit, or a specific control failure. [S4]
The latest financial-impact statement available at the cutoff remained the company’s September 8 Form 8-K. Management expected a material effect on third-quarter and full-year 2026 results, said it was unlikely to meet the outlook issued in July, and said it might recover some affected revenue. It could not yet quantify the full impact and did not expect a material long-term effect on financial condition. No revised outlook or incident-loss estimate was provided in the materials available by October 2. [S2]
The public record therefore showed three different things: operating flows were reported restored; backlogs and customer delays remained in motion; and the full financial impact was still unquantified. The forensic findings narrowed what was known about access but did not resolve every system’s scope. What should management prioritize while these facts remained incomplete?
Growth commitments already in motion
Boston Scientific’s operating plan included several claims on leadership attention and capital. A board-approved restructuring program was expected to extend through 2029, with $700–800 million of pre-tax charges, including $600–700 million in cash charges. As benefits matured, the company estimated $500 million in gross annual pre-tax expense reductions, a substantial portion of which it expected to reinvest in strategic growth. These were pre-incident estimates, not a newly available cybersecurity budget. [S5]
The company had already invested $1.5 billion in MiRus, excluding $100 million paid earlier, for approximately 33.75% fully diluted non-voting equity and an exclusive option tied to MiRus’s TAVR business. After clinical and regulatory milestones, Boston Scientific could make additional payments of up to $3 billion to acquire 100% of the TAVR-Structural Heart NewCo. The initial investment was made; the further payments remained contingent. Public sources did not provide milestone probabilities or an option valuation. [S5, S7, S8]
Boston Scientific had also signed an approximately $14.5 billion agreement to acquire Penumbra for $374 per share. Penumbra shareholders approved the offer in May. A Federal Trade Commission Second Request was outstanding, and the company expected a second-half 2026 close subject to regulatory clearance. It planned to integrate Penumbra into its Cardiovascular business. The transaction was a signed, shareholder-approved commitment awaiting clearance, not a discretionary project that could be treated as costlessly reversible. [S5]
The June 30 financial statements offer a pre-incident reference point, not an updated post-incident forecast. For the first half, Boston Scientific reported $1.822 billion in operating cash flow, $2.547 billion in investing cash outflow and $670 million in financing cash outflow. Investing included $1.501 billion in net payments primarily for MiRus; financing included a $2 billion accelerated repurchase payment. Its covenant leverage ratio was 2.02x against a 4.00x permitted level, subject to specified temporary higher limits after qualified acquisitions. This covenant measure differed from management’s separate gross-debt-to-EBITDA target. None of these historical figures says how much cash was available for a new response after the incident. [S5]
A portfolio with competing uses
Second-quarter results, also before the incident, showed organic growth across the company’s reported units: MedSurg 5.4%, Cardiovascular 7.8%, Neuromodulation 12.2%, Urology 0.8% and Endoscopy 7.0%. Management said Cardiovascular growth was led by AGENT coronary therapies and electrophysiology/FARAPULSE; it also cited competition in electrophysiology and slower WATCHMAN procedures as headwinds. The figures do not reveal product-level returns or how the incident affected each business. [S5]
Research and development expense was $554 million in Q2, 10.2% of sales, and $1.069 billion for the first half, 10.0% of sales. Management attributed the increase to investment across businesses to maintain the future-sales pipeline. It did not disclose the amount devoted to any specific product or project. [S5]
The hypothetical choice
Assume that, on October 2, an executive committee asks you to recommend how Boston Scientific should sequence management attention and capital across incident learning, operational resilience, integration and growth. This assignment is hypothetical. It does not imply that a committee meeting, proposed budget or company decision existed.
Choose and defend one of three approaches:
- Resilience first. Use the independent postmortem to validate whether additional IT/OT recovery work, backup-restoration improvements, continuity routes or supplier/customer coordination are warranted. Protect time and resources for actions supported by that review; slow discretionary growth or integration scope where feasible until clear operating and security gates are met.
- Protect planned growth. Continue the restructuring-to-growth plan, prepare for the planned Penumbra integration and preserve pipeline investment. Address incident remediation through existing programs unless the postmortem establishes a specific unmet need.
- Stage-gated balance. Prioritize evidence-supported incident remediation and resilience work, then release discretionary resources in stages as recovery indicators, the postmortem, leverage and transaction milestones become clearer. Keep contractual commitments distinct from optional future investments, including the contingent MiRus TAVR option.
Each route has costs. A resilience-first approach may reduce future disruption risk but could delay growth or stretch teams already preparing for a large integration. Protecting planned growth may preserve momentum but could leave an unaddressed control or continuity weakness underfunded. A stage-gated approach can preserve flexibility, but its triggers must be specific enough to guide action and avoid delaying work that is committed or necessary.
The evidence does not tell you what controls failed, what a remediation plan would cost, how much backlog remained on October 2, which suppliers or facilities were most exposed, what revenue would return, or what synergies or integration resources Penumbra would require. Do not invent a loss estimate or treat the pre-incident cash and leverage figures as post-incident forecasts. You may identify the additional information needed to decide.
Assignment
Prepare a two-page executive memo that:
- selects one approach and explains its strongest trade-off;
- separates restoration, backlog clearance, future resilience and growth/integration spending;
- identifies what the postmortem and operating evidence must show before further actions or resource releases;
- distinguishes the signed Penumbra transaction from the contingent MiRus option and from the pre-incident restructuring estimates; and
- names the evidence that would cause you to change your recommendation.
Sources
[S1] Boston Scientific, Form 8-K, August 26, 2026, Item 8.01. SEC filing.
[S2] Boston Scientific, Form 8-K, filed September 8, 2026, Item 1.05. SEC filing.
[S3] Boston Scientific, archived cybersecurity update, September 9, 2026. Issuer update.
[S4] Boston Scientific, “Update on the August 25 cybersecurity incident,” September 22, 2026. Issuer newsroom update. The case uses the accessible webpage summary; its linked attachment was unavailable.
[S5] Boston Scientific, Form 10-Q, quarter ended June 30, 2026, filed August 3, 2026. SEC filing.
[S6] Boston Scientific, Form 10-K, year ended December 31, 2025, filed February 17, 2026. SEC filing.
[S7] Boston Scientific, Q2 2026 Financial & Operational Highlights, July 29, 2026. Issuer PDF.
[S8] Boston Scientific, MiRus strategic investment presentation, May 18, 2026. Issuer PDF.