Boston Scientific Hit by Cyberattack, Disrupting Operations and Shipments Boston Scientific, a $72 billion medical device manufacturer specializing in products like pacemakers and stents, disclosed a cyberattack in an SEC filing on Wednesday, causing operational disruptions and a decline in its stock price. Shares fell 5% in premarket trading, adding to a nearly 50% drop this year following a weak first-quarter profit forecast. The attack has impaired the company’s access to critical information systems and applications, including shipment services, with no clear timeline for full restoration. While Boston Scientific is working to recover affected functions, the ongoing incident continues to hinder product shipments. The extent of the breach and its potential impact on patient care or data security remain undisclosed. The disclosure underscores the growing cybersecurity risks facing healthcare and medical device companies, where operational disruptions can have cascading effects on supply chains and market confidence.

Cyberattack on Ceva Logistics Exposes Employee Data, Sparks Class Action Lawsuit A former employee has filed a class action lawsuit against Ceva Logistics, alleging the global freight provider failed to safeguard sensitive personal data stolen in a July cyberattack that disrupted operations across eight warehouses in the Netherlands and Europe. The breach, attributed to the CoinbaseCartel ransomware group, compromised employee information, including bank account details and Social Security numbers. The lawsuit, filed in late August in the U.S. District Court for the Southern District of Texas, claims Ceva neglected to implement adequate security measures despite a prior ransomware attack in September 2025, which the company never publicly disclosed. The complaint also alleges Ceva has not formally notified affected employees, leaving them vulnerable to fraud with the plaintiff reporting credit card fraud and increased spam calls as direct consequences. The filing seeks class action status, citing at least 100 impacted employees (potentially thousands) and demanding $5 million in damages for alleged negligence, breach of contract, and unjust enrichment. The lawsuit argues Ceva prioritized cost-cutting over security, using "cheaper, ineffective measures" that left data exposed. The incident coincides with leadership changes at Ceva, including the departure of two IT executives VP of IT Infrastructure Bryant Duke (November 2025) and Global CIO Susanne Shustein (March 2026). Parent company CMA CGM Group also reassigned Ceva’s CEO, Mathieu Friedberg, to a new role overseeing cybersecurity transformation, signaling broader concerns about enterprise-wide vulnerabilities. Healthcare Sector Also Targeted In a separate incident, McKesson Corp. confirmed a cybersecurity breach last week, with hackers allegedly the ShinyHunter group stealing customer and employee data from two business units. The group is demanding a $55 million ransom to prevent public release. McKesson joins a growing list of healthcare and medical device firms hit by ransomware in 2026, including Boston Scientific, which suffered a network outage in a recent attack.

DAEMON Tools Supply Chain Attack Distributes Backdoors via Trojanized Installers In May 2026, Kaspersky researchers uncovered a sophisticated supply chain attack targeting users of DAEMON Tools, a widely used disk image mounting software. The compromised installers versions 12.5.0.2421 through 12.5.0.2434 were distributed directly from the official website beginning April 8, 2026, and remained available for nearly a month. The attackers embedded malicious payloads in three core binaries within the installation directory (DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe). Upon execution at system startup, the malware triggered a backdoor that communicated with a typosquatted command-and-control (C2) domain env-check.daemontools[.]cc registered on March 27, 2026, just days before the attack commenced. The campaign affected thousands of systems across over 100 countries, with the majority of victims located in Russia, Brazil, Turkey, Spain, Germany, France, Italy, and China. While 90% of infections targeted individual users, a smaller subset of retail, scientific, government, and manufacturing organizations primarily in Russia, Belarus, and Thailand received advanced payloads, suggesting a targeted espionage or "big game hunting" motive. The attack employed a three-stage payload chain: 1. Information Collector (*envchk.exe*) – A .NET-based tool that harvested system details (MAC address, hostname, installed software, processes) and exfiltrated data to 38.180.107[.]76. The presence of Chinese-language strings in its code pointed to a likely Chinese-speaking threat actor. 2. Minimalistic Backdoor (*cdg.exe*) – An RC4-encrypted shellcode loader deployed to roughly a dozen high-value machines, enabling file downloads, command execution, and in-memory shellcode deployment. 3. QUIC RAT – A sophisticated C++ implant, observed in a single attack against a Russian educational institution, featuring multi-protocol C2 communication (HTTP, UDP, TCP, WSS, QUIC, DNS, HTTP/3) and process injection capabilities. The trojanized installers were signed with legitimate digital certificates from AVB Disc Soft, the software’s developer, allowing them to bypass security tools. Key indicators of compromise (IOCs) include the malicious C2 domain, the IP address 38.180.107[.]76, and specific file hashes for the infected installers and payloads. Suspicious file paths, such as C:\Windows\Temp\envchk.exe and %AppData%\Microsoft\mcrypto.dat, were also identified.

Veradigm Data Breach Exposes Patient Information in Vendor-Linked Cyberattack Veradigm, a Chicago-based electronic health records provider serving thousands of hospitals and physicians worldwide, disclosed a data breach on Tuesday after hackers infiltrated a vendor’s systems and stole sensitive customer information, including Social Security numbers. The company, which reported $594 million in 2024 revenue, revealed in an SEC filing that an unauthorized party obtained credentials from the vendor’s environment to access a Veradigm API, enabling the theft of personal data though no clinical or medical records were compromised. The breach was confined to a specific interface, with no impact on Veradigm’s broader infrastructure or operations. While the exact timeline remains unclear, the incident has been reported to law enforcement, and an investigation is ongoing. Veradigm has not responded to requests for further comment. The Gentlemen ransomware gang, which has targeted multiple healthcare organizations since emerging last fall, claimed responsibility for the attack, asserting it stole records of 3.5 million patients. The group recently breached other healthcare entities, including Nutex and AnMed. Veradigm, formerly known as Allscripts, has faced prior cybersecurity incidents, including a 2019 SamSam ransomware attack that disrupted hospital operations and led to class action lawsuits. In December 2025, the company reported another breach affecting 2.6 million individuals, stemming from an incident in late 2024. The healthcare sector remains a prime target for cyberattacks, with millions of records exposed in recent months. Aesto disclosed a breach affecting 9 million individuals last week, while Baylor Genetics reported the theft of 2.8 million medical testing records in June. Other incidents, including a March breach at CareCloud and recent attacks on Paylogix, have further highlighted vulnerabilities in health data security. Separately, Boston Scientific confirmed ongoing operational disruptions from a cyberattack, which has hindered its distribution network and remote monitoring systems for cardiac devices. The company expects the incident to impact financial performance, delaying its ability to meet quarterly net sales targets. While some systems have been restored, full recovery remains uncertain.

Federal prosecutors in the U.S. accused a trio—including Ryan Clifford Goldberg, Kevin Tyler Martin, and an unnamed co-conspirator—of deploying BlackCat (ALPHV) ransomware against this Tampa-based medical device firm in May 2023. The attackers infiltrated the company’s network, exfiltrated sensitive data, and encrypted systems, demanding a $10 million ransom. While negotiations reduced the payment, the company ultimately transferred $1.274 million in cryptocurrency to regain access to its systems and prevent further data leaks. The attack disrupted operations, risked exposure of proprietary medical device designs, and compromised internal employee and customer data—including potentially health records, financial details, and intellectual property. The incident forced the company to engage in costly incident response, legal consultations, and system recovery efforts. The FBI’s investigation later revealed that one of the perpetrators (Goldberg) was a cybersecurity incident response manager at Sygnia, exploiting insider knowledge to facilitate the attack. The breach not only caused financial losses but also reputational damage, as the company’s failure to prevent the attack eroded trust among partners and clients. The case remains under legal scrutiny, with two defendants facing up to 50 years in prison if convicted.