Cyberattack disrupts manufacturing and shipments; material hit to 2026 financials likely

What happened

Boston Scientific disclosed on September 8, 2026 that a cybersecurity incident has disrupted global manufacturing and order shipments, with the company stating the attack is likely to have a material impact on third-quarter and full-year 2026 sales and profit. This new operational shock compounds an already fragile setup—prior to the attack, BSX was struggling with worse-than-expected electrophysiology share loss and a sharp deceleration in Watchman procedure volumes, both of which had driven a guidance reset earlier in 2026. The cyberattack introduces unplanned downtime and remediation costs that will pressure near-term revenue and margins, directly undermining the free cash flow needed to fund the pending ~$14.5B Penumbra acquisition while preserving leverage headroom. With the balance sheet already set to absorb ~$11.0B in additional debt for Penumbra, any sustained cash conversion shortfall raises the probability of covenant stress or a costly delay/renegotiation of the deal. Net, the cyberattack erodes the operational buffer that management had been relying on to navigate 2026, making the path to stabilization of EP and Watchman less certain and increasing the downside risk to the equity.

Implication

Near-term revenue and margins will likely miss prior expectations, and the disruption may extend into 2027 if manufacturing systems or logistics remain compromised. Free cash flow, already weak at $171M in Q1 2026, faces further pressure, which could force management to choose between funding the Penumbra acquisition, maintaining share repurchases, or preserving investment-grade ratings. The incident also introduces new operational risk that may delay the close of Penumbra or alter its financing terms, adding uncertainty to the deal's accretion math. Management credibility takes another hit after earlier guidance resets, potentially leading to a lower re-rating multiple if investors demand a higher risk premium. Absent a swift and complete recovery, the attractive entry level of $52 identified in the prior report likely no longer offers sufficient margin of safety, and a reassessment of the base case is warranted.

Thesis delta

The prior thesis was WAIT, predicated on EP and Watchman stabilization by H2 2026 and manageable leverage into the Penumbra close. The cyberattack introduces a new, unmodeled operational risk that directly threatens near-term financial performance and free cash flow, which could derail the stabilization timeline and increase balance sheet stress. As a result, the margin of safety shrinks, and the attractive entry point of $52 may need to be revised downward; the rating remains WAIT but with reduced conviction and a lower threshold for re-entry.