---
title: "What cyberattacks cost, as filed: Boston Scientific 1.7 margin points, Waystar US$1.4m"
summary: "What cyberattacks cost US-listed companies, in their own quarterly filings to 30 September 2026: lost margin, direct expenses, insurance and settlements, and what SEC rules ask for."
url: https://www.thetechbag.com/blog/cyberattack-costs-in-company-filings
format: Trend
desk: "Security"
area: "Risk & compliance"
region: Global
published: 2026-11-07
facts_checked: 2026-11-07
author: TechBag (The TechBag Journal)
tags: ["Boston Scientific","Waystar","HealthStream","iRhythm","CareCloud","Conduent","West Pharmaceutical","Krispy Kreme","Ahold Delhaize","cost of a cyberattack","SEC Item 1.05","Form 8-K","Form 10-Q","materiality","cyber insurance","gross margin","adjusted EBITDA","incident disclosure"]
cover: https://www.thetechbag.com/blog/covers/cyberattack-costs-in-company-filings.png
---

# What cyberattacks cost, as filed: Boston Scientific 1.7 margin points, Waystar US$1.4m

*What cyberattacks cost US-listed companies, in their own quarterly filings to 30 September 2026: lost margin, direct expenses, insurance and settlements, and what SEC rules ask for.*

Trend · Security · Risk & compliance · By TechBag · Published 2026-11-07 · Facts checked 2026-11-07 · Canonical: https://www.thetechbag.com/blog/cyberattack-costs-in-company-filings

The short version

1. Boston Scientific’s August cyberattack took 1.7 points off its gross margin in the quarter to 30 September, which fell to 66.7% from 69.9%. Its sales grew 1.5%, against 3–5% guided in July, and it expects them to fall 1–3% this quarter.[1][2][5]
2. Other companies’ figures are small and of different kinds: US$1.4m of direct costs at Waystar, US$250,000 after insurance at HealthStream, US$142,000 at iRhythm, a US$100,000 insurance retention at CareCloud. Conduent’s insurers are to fund an US$80m settlement for an attack in January 2025.[7][8][9][10][11]
3. SEC rules ask for the material impact of a material attack, not a figure. Of 137 quarterly reports filed since mid-October that use the phrase “cybersecurity incident”, we found at least 15 that describe an attack on the company this year; five put a number on its cost.[17][19]

Boston Scientific’s cyberattack took 1.7 percentage points off its gross margin in the quarter to 30 September; on US$5.138bn of sales, that is about US$85m, by our arithmetic. The company did not put it in dollars.[1] It is the largest cost we found attached to an attack this year in the US quarterly reports filed since mid-October, and one of only five such figures. This piece lines up what those companies counted, how each measured it, and why most gave nothing at all.

## Boston Scientific: one quarter, measured in margin points

The medical-device maker identified the incident on 25 August. A filing the next day, under Item 8.01, said it had disrupted its ability to “process and ship customer orders” and that the company had “not yet determined” whether it was material.[3] On 8 September it filed under Item 1.05, for material incidents: the attack was “likely to have a material impact” on third-quarter and full-year results, and it was unlikely to meet its guidance. Major distribution centres were by then shipping “at or above normal operating levels”, and manufacturing had resumed at most sites.[4]

Sales in the quarter rose 1.5% to US$5.138bn, against the 3–5% the company had guided on 29 July; over nine months they rose 6.7%. It also names competition in electrophysiology and a slower market for its Watchman heart implant, and does not say how much of the shortfall is the attack. It now guides sales down 1–3% in the fourth quarter and growth of about 4.25% for 2026, from 5.5–6.5% in July.[1][2][5]

The margin is where it does count. Its quarterly report walks the gross margin from 69.9% to 66.7%: 0.3 points from price, volume and mix, 0.2 from currency, 1.1 from other items, and 1.7 points of “abnormal production variances from cybersecurity incident”, the cost of plants standing idle. Selling and administrative costs also carried “incremental expenses” from the attack, not quantified. None of it is excluded from the company’s adjusted earnings, which strip out litigation and restructuring charges but have no line for the attack. “We may not recover all of the revenue impacted by the incident”, the report says, and civil claims have been filed.[1][2]

**Figure: Boston Scientific's gross margin fell to 66.7% in the quarter of its attack, the lowest in six quarters**

*GAAP gross profit as a share of net sales, %, quarters from April–June 2025 to July–September 2026*

|  | Gross margin |
| --- | --- |
| Q2 25 | 67.7 |
| Q3 25 | 69.9 |
| Q4 25 | 69.6 |
| Q1 26 | 69.4 |
| Q2 26 | 70.7 |
| Q3 26 | 66.7 |

Source: Boston Scientific quarterly results releases (8-K Exhibit 99.1) and Q3 2026 Form 10-Q; TechBag arithmetic on gross profit and net sales · as of 2 November 2026 · The company attributes 1.7 points of the Q3 2026 margin to the attack

TechBag countHow we turned 1.7 points into about US$85m

The bridge states the cost as a share of sales, rounded to one decimal. 1.7% of US$5.138bn of third-quarter sales is US$87m (US$85m to US$90m with rounding); 0.5% of US$15.784bn of nine-month sales, the same line for the year to date, is US$71m to US$87m. Both fit about US$85m.[1]

## Four ways to count a cost, and why they do not add up

**Lost sales.** Ahold Delhaize gave the fullest estimate of this reporting season: its October attack is to cost €200–250m of fourth-quarter sales and €75–100m of operating income, while the response itself costs a “marginal” amount ([our Note](https://www.thetechbag.com/blog/ahold-delhaize-cyberattack-cost-200-250m-euros)).[15][16]

**Margin.** Besides Boston Scientific, West Pharmaceutical told investors in May that an attack had encrypted systems and taken data, and that it was not reasonably likely to have a material impact on its guidance.[14] Its quarterly report now says its West Vantage unit’s gross margin fell 2.3 points over nine months, partly from “production downtime” after the attack and partly from inflation; its US$9.2m of one-off professional fees also mixes the attack with legal matters. Neither share is given.[13]

**Direct costs.** Waystar, a healthcare-payments software company, counted US$1.4m in the quarter and US$3.0m in nine months for a June incident in which copies of test source code and four files of inactive data were taken; it adds the cost back to its adjusted EBITDA.[7] HealthStream reported US$250,000 “after giving effect to related insurance recoveries”.[8] iRhythm counted US$142,000 in the quarter and US$828,000 in nine months, net of expected insurance recoveries.[9] CareCloud expects its insurer to pay everything except a US$100,000 retention it has accrued.[10]

**Settlements and recoveries, years later.** Conduent agreed on 16 October to settle the class action over its January 2025 attack for US$80m, to be funded by its insurers and subject to court approval; it booked US$25m of direct response costs in early 2025.[11] Krispy Kreme, which found its attack on 29 November 2024, spent US$6.8m on remediation in the first three quarters of 2025 and booked US$9.3m of business-interruption insurance in the third.[12]

**Figure: Stated attack costs run from US$100,000 to about US$85m, and each company counts something different**

*Cost of an attack as each company states it, US$ million; the quarter to 30 September 2026 unless noted*

Boston Scientific

margin lost to idle plants

85 US$m

Conduent

class settlement, insurers pay

80 US$m

Waystar

direct costs, added back

1.4 US$m

HealthStream

after insurance

0.25 US$m

iRhythm

net of expected insurance

0.14 US$m

CareCloud

insurance retention

0.1 US$m

|  | Value (US$m) |
| --- | --- |
| Boston Scientific | 85 |
| Conduent | 80 |
| Waystar | 1.4 |
| HealthStream | 0.25 |
| iRhythm | 0.14 |
| CareCloud | 0.1 |

Source: Company Form 10-Q filings, 29 October to 5 November 2026; TechBag arithmetic for Boston Scientific · as of 5 November 2026 · Boston Scientific: about, from 1.7 points of gross margin. Conduent: a settlement agreed on 16 October, for a 2025 attack

## Why most filings say nothing, and what to watch

The SEC’s rules, adopted on 26 July 2023, require a filing under Item 1.05 within four business days of a company deciding an attack is material, describing its “nature, scope, and timing” and its material or reasonably likely material impact. They do not ask for a dollar figure.[17] In May 2024 the SEC’s Division of Corporation Finance asked companies to use Item 8.01 for attacks not yet judged material, as Boston Scientific did first, and said materiality should weigh “qualitative factors alongside quantitative factors”, such as harm to reputation or customer relationships.[18] That is how an attack can be material, as West’s was, while its owner expects no material effect on guidance.

TechBag count137 quarterly reports, 15 attacks, five figures

EDGAR’s full-text search finds 137 Form 10-Q filings made between 13 October and 6 November 2026 that use the phrase “cybersecurity incident”. We read the passages in each. Most use it only in risk factors. At least 15 describe an attack on the company itself during 2026. Five put a figure on what it cost: Boston Scientific, Waystar, HealthStream, iRhythm and CareCloud. West gives figures that mix the attack with other items; the other nine give none.[19]

**What to watch.** Boston Scientific’s fourth-quarter results: whether the sales it expects to recover from its backlog arrive, and whether the margin line recurs. Ahold Delhaize’s full-year results, which will show the actual cost against its estimate. Court approval of Conduent’s settlement. And insurance: payouts land quarters after the attack, as Krispy Kreme’s did, so a company’s cost in one filing can be partly reversed in a later one.[4][11][12]

Our viewOur view: three questions for any attack cost

Is it before or after insurance? Is it in the reported results or added back to an adjusted measure? Does it include sales that never happened? The figures above answer those questions differently, so they cannot be ranked against each other. For a buyer, the useful comparison is the way Boston Scientific and Ahold Delhaize lost money: plants and stores that could not run, rather than the bill for investigating the attack.

How we did this

Figures as of 7 November 2026, 4pm IST

Every figure is from the company’s own filing with the SEC, or for Ahold Delhaize from its 4 November release. Boston Scientific’s gross margin is GAAP gross profit divided by net sales, from its quarterly results releases; the third quarters of 2025 and 2026 are as printed in its 10-Q. The company gives no dollar figure for the attack; ours is arithmetic on its rounded margin lines, shown in the count box. The 137 filings are an EDGAR full-text search for the exact phrase “cybersecurity incident” in Form 10-Q filings, 1 October to 7 November 2026; filings that describe an attack in other words are not in it. “An attack on the company itself” excludes incidents at suppliers and older attacks; Delek US and its partnership Delek Logistics describe one incident and count once. Conduent’s and Krispy Kreme’s attacks are older and are not in the 15. No attacker is named here; none of these companies names one.

Spotted an error? Write to us; corrections are published at the foot of the piece.

Sources

1. [Boston Scientific, Form 10-Q for the quarter ended 30 September 2026 (MD&A: gross profit bridge, SG&A; Item 1A)](https://www.sec.gov/Archives/edgar/data/885725/000088572526000070/bsx-20260930.htm) — 2 November 2026
2. [Boston Scientific, Boston Scientific announces results for third quarter 2026 (8-K, Exhibit 99.1)](https://www.sec.gov/Archives/edgar/data/885725/000088572526000066/earningsrelease_live.htm) — 28 October 2026
3. [Boston Scientific, Form 8-K, Item 8.01 Other Events (cybersecurity incident)](https://www.sec.gov/Archives/edgar/data/885725/000088572526000056/bsx-20260826.htm) — 26 August 2026
4. [Boston Scientific, Form 8-K, Item 1.05 Material Cybersecurity Incidents](https://www.sec.gov/Archives/edgar/data/885725/000088572526000059/bsx-20260907.htm) — 8 September 2026
5. [Boston Scientific, results for second quarter 2026, with Q3 and full-year guidance (8-K, Exhibit 99.1)](https://www.sec.gov/Archives/edgar/data/885725/000088572526000051/q22026earningsrelease.htm) — 29 July 2026
6. [Boston Scientific, quarterly results releases for Q2 2025 to Q1 2026 (8-K, Exhibit 99.1), SEC EDGAR filing list](https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=885725&type=8-K) — 23 July 2025 to 22 April 2026 Gross profit and net sales for the first four columns of the margin chart.
7. [Waystar Holding Corp., Form 10-Q for the quarter ended 30 September 2026 (adjusted EBITDA note (a); Item 1A)](https://www.sec.gov/Archives/edgar/data/1990354/000199035426000041/way-20260930.htm) — 2 November 2026
8. [HealthStream, Form 10-Q for the quarter ended 30 September 2026 (cybersecurity incident)](https://www.sec.gov/Archives/edgar/data/1095565/000143774926035320/hstm20260930_10q.htm) — 5 November 2026
9. [iRhythm Holdings, Form 10-Q for the quarter ended 30 September 2026 (Cybersecurity Incident; adjusted EBITDA reconciliation)](https://www.sec.gov/Archives/edgar/data/1388658/000138865826000094/irtc-20260930.htm) — 5 November 2026
10. [CareCloud, Form 10-Q for the quarter ended 30 September 2026 (Cybersecurity Incident)](https://www.sec.gov/Archives/edgar/data/1582982/000149315226050254/form10-q.htm) — 5 November 2026
11. [Conduent, Form 10-Q for the quarter ended 30 September 2026 (January 2025 Cyber Event; settlement agreement)](https://www.sec.gov/Archives/edgar/data/1677703/000167770326000154/cndt-20260930.htm) — 5 November 2026
12. [Krispy Kreme, Form 10-Q for the quarter ended 27 September 2026 (2024 Cybersecurity Incident; other expense/(income))](https://www.sec.gov/Archives/edgar/data/1857154/000185715426000055/dnut-20260927.htm) — 5 November 2026
13. [West Pharmaceutical Services, Form 10-Q for the quarter ended 30 September 2026 (segment results; corporate items)](https://www.sec.gov/Archives/edgar/data/105770/000010577026000121/wst-20260930.htm) — 29 October 2026
14. [West Pharmaceutical Services, Form 8-K/A, Item 1.05 Material Cybersecurity Incidents](https://www.sec.gov/Archives/edgar/data/105770/000010577026000077/wst-20260507.htm) — 20 May 2026
15. [The TechBag Journal: Ahold Delhaize's cyberattack: €200–250m of lost sales, up to €100m of profit](https://www.thetechbag.com/blog/ahold-delhaize-cyberattack-cost-200-250m-euros) — 6 November 2026
16. [Ahold Delhaize, Q3 2026 results and updated 2026 guidance reflecting the cybersecurity incident](https://newsroom.aholddelhaize.com/ahold-delhaize-reports-resilient-q3-2026-results-and-updates-2026-guidance-to-reflect-business-disruption-caused-by-recent-cybersecurity-incident/) — 4 November 2026
17. [US SEC, SEC Adopts Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies (press release 2023-139)](https://www.sec.gov/newsroom/press-releases/2023-139) — 26 July 2023
18. [US SEC, Erik Gerding, Director, Division of Corporation Finance: Disclosure of Cybersecurity Incidents Determined To Be Material and Other Cybersecurity Incidents](https://www.sec.gov/newsroom/speeches-statements/gerding-cybersecurity-incidents-05212024) — 21 May 2024
19. [SEC EDGAR full-text search: "cybersecurity incident", Form 10-Q, filed 1 October to 7 November 2026 (137 results); TechBag reading of each filing](https://efts.sec.gov/LATEST/search-index?q=%22cybersecurity%20incident%22&dateRange=custom&startdt=2026-10-01&enddt=2026-11-07&forms=10-Q) — Filings of 13 October to 6 November 2026

**Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.

**Read this next:** [Ahold Delhaize’s cyberattack: €200–250m of lost sales, up to €100m of profit](https://www.thetechbag.com/blog/ahold-delhaize-cyberattack-cost-200-250m-euros) — One attack’s cost to a grocer’s quarter: Ahold Delhaize expects €200–250m of lost sales and up to €100m of profit.

Go deeper on TechBag

- [Cyber recovery guide](https://www.thetechbag.com/browse/backup-cyber-resilience/cyber-recovery) — restoring systems from a clean copy, the step that decides how long plants and orders stand still
- [Disaster recovery guide](https://www.thetechbag.com/browse/backup-cyber-resilience/disaster-recovery) — recovery-time targets for the manufacturing, order and shipping systems an attack takes offline
- [Managed detection and response guide](https://www.thetechbag.com/browse/security/managed-detection-response) — outside teams that detect an intrusion early and help contain it