What cyberattacks cost, as filed: Boston Scientific 1.7 margin points, Waystar US$1.4m

01Boston Scientific: one quarter, measured in margin points

The medical-device maker identified the incident on 25 August. A filing the next day, under Item 8.01, said it had disrupted its ability to “process and ship customer orders” and that the company had “not yet determined” whether it was material.³ On 8 September it filed under Item 1.05, for material incidents: the attack was “likely to have a material impact” on third-quarter and full-year results, and it was unlikely to meet its guidance. Major distribution centres were by then shipping “at or above normal operating levels”, and manufacturing had resumed at most sites.⁴

Sales in the quarter rose 1.5% to US$5.138bn, against the 3–5% the company had guided on 29 July; over nine months they rose 6.7%. It also names competition in electrophysiology and a slower market for its Watchman heart implant, and does not say how much of the shortfall is the attack. It now guides sales down 1–3% in the fourth quarter and growth of about 4.25% for 2026, from 5.5–6.5% in July.¹²⁵

The margin is where it does count. Its quarterly report walks the gross margin from 69.9% to 66.7%: 0.3 points from price, volume and mix, 0.2 from currency, 1.1 from other items, and 1.7 points of “abnormal production variances from cybersecurity incident”, the cost of plants standing idle. Selling and administrative costs also carried “incremental expenses” from the attack, not quantified. None of it is excluded from the company’s adjusted earnings, which strip out litigation and restructuring charges but have no line for the attack. “We may not recover all of the revenue impacted by the incident”, the report says, and civil claims have been filed.¹²

02Four ways to count a cost, and why they do not add up

Lost sales. Ahold Delhaize gave the fullest estimate of this reporting season: its October attack is to cost €200–250m of fourth-quarter sales and €75–100m of operating income, while the response itself costs a “marginal” amount (our Note).¹⁵¹⁶

Margin. Besides Boston Scientific, West Pharmaceutical told investors in May that an attack had encrypted systems and taken data, and that it was not reasonably likely to have a material impact on its guidance.¹⁴ Its quarterly report now says its West Vantage unit’s gross margin fell 2.3 points over nine months, partly from “production downtime” after the attack and partly from inflation; its US$9.2m of one-off professional fees also mixes the attack with legal matters. Neither share is given.¹³

Direct costs. Waystar, a healthcare-payments software company, counted US$1.4m in the quarter and US$3.0m in nine months for a June incident in which copies of test source code and four files of inactive data were taken; it adds the cost back to its adjusted EBITDA.⁷ HealthStream reported US$250,000 “after giving effect to related insurance recoveries”.⁸ iRhythm counted US$142,000 in the quarter and US$828,000 in nine months, net of expected insurance recoveries.⁹ CareCloud expects its insurer to pay everything except a US$100,000 retention it has accrued.¹⁰

Settlements and recoveries, years later. Conduent agreed on 16 October to settle the class action over its January 2025 attack for US$80m, to be funded by its insurers and subject to court approval; it booked US$25m of direct response costs in early 2025.¹¹ Krispy Kreme, which found its attack on 29 November 2024, spent US$6.8m on remediation in the first three quarters of 2025 and booked US$9.3m of business-interruption insurance in the third.¹²

03Why most filings say nothing, and what to watch

The SEC’s rules, adopted on 26 July 2023, require a filing under Item 1.05 within four business days of a company deciding an attack is material, describing its “nature, scope, and timing” and its material or reasonably likely material impact. They do not ask for a dollar figure.¹⁷ In May 2024 the SEC’s Division of Corporation Finance asked companies to use Item 8.01 for attacks not yet judged material, as Boston Scientific did first, and said materiality should weigh “qualitative factors alongside quantitative factors”, such as harm to reputation or customer relationships.¹⁸ That is how an attack can be material, as West’s was, while its owner expects no material effect on guidance.

What to watch. Boston Scientific’s fourth-quarter results: whether the sales it expects to recover from its backlog arrive, and whether the margin line recurs. Ahold Delhaize’s full-year results, which will show the actual cost against its estimate. Court approval of Conduent’s settlement. And insurance: payouts land quarters after the attack, as Krispy Kreme’s did, so a company’s cost in one filing can be partly reversed in a later one.⁴¹¹¹²