Cyberattack Disrupts Boston Scientific’s Remote Monitoring Capabilities for Cardiac Devices
In a significant blow to the medical technology sector, Boston Scientific, based in Marlborough, Massachusetts, recently fell victim to a cyberattack that has halted crucial operations at the company. This unfortunate incident is affecting the remote monitoring capabilities of some newly implanted cardiac devices, posing potential challenges for both healthcare professionals and patients.
The cyberattack unfolded earlier this week and was officially reported by Boston Scientific to the U.S. Securities and Exchange Commission on Wednesday. This step exemplifies the ongoing commitment of the company to maintain transparency and inform stakeholders about developments that may impact their operations. As of Friday, no hacking group publicly claimed responsibility for the attack.
In a follow-up communication issued late Thursday, Boston Scientific reassured concerned stakeholders that investigations into the potential impacts of the cyberattack are ongoing. The company has made it clear that, thus far, no operational issues have been detected with the implantable cardiac rhythm management devices themselves, nor have there been any complications regarding healthcare professionals’ access to remote patient management data for devices that were functioning before the disruption occurred.
However, the company acknowledged that the IT disruption is hindering the activation of remote monitoring for certain new cardiac implant devices. Specifically, Boston Scientific stated that for newly implanted devices, aside from insertable cardiac monitors, new remote monitoring communicators cannot be activated during the ongoing IT issues. This translates to a critical gap: available device data will remain untransmitted to remote patient management systems until the communicators are able to be activated.
In particular, newly implanted insertable cardiac monitor (ICM) devices are also feeling the impact of the cyberattack. The company stated that these devices must be activated using the Boston Scientific Clinic Assistant app, a mobile application intended to facilitate remote monitoring. Due to the current limitations, newly implanted ICMs are unable to pair with the patient’s remote monitoring mobile phone. Consequently, data recorded by these monitors will not be sent to the remote monitoring systems until the necessary pairing can take place.
Boston Scientific further clarified that cardiac episodes would continue to be recorded by the ICM devices. However, the transmission of this data will only be possible via an in-person interrogation of the device using the Clinic Assistant app. Patients and healthcare providers can trigger this interrogation manually by selecting the “Interrogate” button within the app, thus ensuring that critical cardiac episode data still reaches the healthcare team, albeit through more traditional means.
The company has provided assurances that once its IT systems are restored, the devices will be able to transmit all recorded data to the remote monitoring system without further interruption. However, an exact timeline for full restoration has yet to be determined, leaving both patients and healthcare providers in a state of uncertainty.
In addition to the complications surrounding remote monitoring, Boston Scientific is currently unable to process or ship customer orders. The company has stated that while electronic orders can be received and logged into a queue for future fulfilment, no goods can be dispatched until the systems are back online. This situation extends to orders placed through the Global Health Exchange, which will also remain on hold until operational capabilities are fully restored.
Despite the challenges, Boston Scientific has indicated that progress is being made toward recovering core business systems. Restoration efforts are currently concentrated on those IT systems that hold the greatest importance for customer interactions and product delivery.
As this situation continues to develop, Boston Scientific remains under scrutiny for further updates regarding the incident’s impact on patient safety and the operational integrity of its cardiac devices. Continuous monitoring from both the industry and affected stakeholders will be instrumental in addressing the fallout from this significant cybersecurity breach, underscoring the critical need for robust cyber defenses in the healthcare sector.