On August 25, 2026, Boston Scientific detected an intrusion in its IT systems. The company reported it to the SEC the next day. Within hours, global order processing and shipping for pacemakers, stents, defibrillators, and WATCHMAN implants stopped. Production at the Cork, Ireland site paused and workers were sent home. Trade press reporting put the recovery at roughly three weeks before manufacturing, ordering, and shipping were back to normal.
Boston Scientific was not alone. Stryker, Medtronic, and Abbott have each disclosed cyberattacks in 2026, according to MedTech Dive. Four of the largest device makers in the world, in one year.
Keystone does not sell implantables. We sell the consumables that fill the same supply rooms, and the outage pattern is identical: the factory is fine, the warehouse is full, and the order system that connects them is down. This post is the plan for that pattern.
The failure is the order system, not the plant
Hurricanes and fires destroy capacity. Cyberattacks freeze it. During the Boston Scientific outage, product sat on shelves that no one could pick, pack, or invoice because the ERP, the customer portal, and the EDI connections were offline. That is a different problem from a shortage, and it needs a different response.
A shortage is solved with alternates and allocation. An outage is solved with a second path to the same product, or a second product you already approved. Ideally both.
The six-step plan
1. Map exposure by manufacturer, not by SKU. Pull twelve months of purchasing and group it by manufacturer. Any manufacturer that supplies more than a third of a clinical category is a single point of failure. Most facilities find three to six of them. Write the list down.
2. Pre-approve an alternate for every item on that list. Value analysis committees take weeks. Allocation letters arrive on a Friday. If the alternate is not already approved, it is not an alternate. We covered the mechanics in Approve Your Backup Vendor Before You Need One.
3. Know what your distributor holds versus drop-ships. Ask your distributor for a simple answer on each of your top 50 items: stocked in a warehouse they control, or shipped from the manufacturer? When the manufacturer goes dark, only the first category ships. Keystone shows this on every listing: "In stock at our Edina, MN warehouse" means we can pick it today; "ships direct from the manufacturer" means we cannot if that manufacturer's systems are down.
4. Hold a protective par on cheap-to-hold consumables. Gloves, isolation gowns, IV administration sets, gauze, prep pads, and specimen supplies are cheap to warehouse and expensive to run out of. Thirty days on hand for that list is a small carrying cost against a three-week outage. Health systems with an open purchase order or standing order can have Keystone hold that buffer in Minnesota under a dedicated stocking agreement.
5. Keep an offline ordering path. A portal outage at your supplier should not stop your orders. Confirm that your distributor accepts purchase orders by email and phone, that a named person answers, and that the acknowledgment still comes back with a ship date. Test it once a quarter.
6. Watch the signals. Cyber disclosures now show up in SEC filings, manufacturer customer notices, and trade press within a day or two. Keystone's disruption monitor tracks manufacturer outages, recalls, and allocations by category so you see the notice before the backorder.
The part nobody wants to own
Your own systems are part of the supply chain. Two practical controls: use unique credentials for supplier portals, and verify every request to change payment or remit-to details by phone with a known contact. Attackers who compromise a supplier often use that access to redirect payments, and a fraudulent remit change costs more than a delayed shipment.
What to ask your distributor this week
- Which of my top 50 items do you physically stock, and where?
- Which manufacturers have you pre-qualified as alternates in each category?
- If your portal is down, how do I place and confirm an order?
- Will you hold a 30-day buffer for me under a standing order, and at what carrying terms?
Keystone answers all four in writing. Request a continuity review or send a quote request with your top-50 list.
Sources
- MedTech Dive, "Cyberattacks have plagued the medtech industry in 2026": https://www.medtechdive.com/news/cyberattacks-have-plagued-the-medtech-industry-in-2026/828489/
- Medical Economics, "When a device maker goes dark: What the Boston Scientific cyberattack means for your patients": https://www.medicaleconomics.com/view/when-a-device-maker-goes-dark-what-the-boston-scientific-cyberattack-means-for-your-patients
- Tech Times, "Boston Scientific Cyberattack Halts Shipments": https://www.techtimes.com/articles/325721/20260827/boston-scientific-cyberattack-halts-shipments-weeks-device-delays-threaten-hospital-supply.htm