The U.S.-based medical device coating company Surmodics reported that it fell victim to a cyberattack on June 5, forcing it to shut down parts of its IT systems as a protective measure. Despite the disruption, the company maintained critical operations using alternative methods to process orders and distribute products.
Headquartered in Minnesota, Surmodics is the leading supplier of hydrophilic coatings used in intravascular devices to reduce friction. After detecting unauthorized access, the company activated security protocols and notified authorities, according to a filing with the SEC.
This incident makes Surmodics the third publicly traded medical device company to report a cyberattack to the SEC in recent months, following Artivion (December) and Masimo (May). Although the company has partially restored its systems with the help of cybersecurity experts, it is still assessing the extent of data theft and continues working toward full recovery.
In its SEC filing, CFO Timothy Arens warned of potential risks stemming from the attack, including:
- Operational disruptions during system reactivation.
- Diversion of management’s attention from critical tasks.
- Potential lawsuits or regulatory penalties.
- Shifts in customer trust.
So far, no hacker group has claimed responsibility, and Surmodics maintains that no confidential company or third-party data has been leaked. The company holds a cyber insurance policy, which it expects will cover most associated costs.
The attack comes amid growing legal pressure on companies affected by data breaches. Recently, major firms like Coinbase and Krispy Kreme faced class-action lawsuits over security incidents exposing sensitive information.
Additionally, Surmodics is embroiled in an FTC lawsuit seeking to block its potential $627 million acquisition by a private equity firm, arguing the merger would create a monopoly in the medical coatings market. Despite these challenges, the company reported $28 million in revenue last quarter.
In summary: While Surmodics advances in its technical recovery, the cyberattack’s repercussions could extend to legal, financial, and reputational consequences.
By: Nestor Castillo, ForAllTechNews Director