Medical Device Maker Reports Data Theft Hack to SEC

UFP Technologies, a Massachusetts-based maker of single-use medical devices and other healthcare supplies, has notified the U.S. Securities and Exchange Commission of a cyber incident discovered on Valentine’s Day that involved the theft or destruction of some company data.

See Also: AI vs. AI: Leveling the Defense Playing Field

In a SEC filing on Tuesday, UFP said it detected suspicious activity in its IT systems on Feb. 14. The company said it took immediate steps to contain and remediate the incident, including isolating the affected systems.

UFP told the SEC it believes the threat actor responsible for the incident has been booted from the company’s IT systems, and UFP’s ability to access affected information “has been restored in all material respects.”

Nonetheless, some UFP or company-related data appears to have been stolen or destroyed, the filing said.

“As a result of the company’s contingency plans and data backup systems, the company implemented planned solutions for the issues posed by the incident. The company’s operations have continued since the detection of the cybersecurity incident in all material respects,” UFP told the SEC.

The incident affected IT systems for functions such as billing and label making for customer deliveries, UFP said.

UFP is still investigating the extent of any sensitive or personal information contained in the affected systems and files.

So far, the incident has not had material impact on UFP’s financial systems, operations or financial condition, the filing said.

“The company currently expects that a significant portion of its direct costs incurred relating to containing, investigating and remediating the cybersecurity incident will be reimbursed through insurance recoveries,” UFP said.

UFP describes itself as “a designer and custom manufacturer of comprehensive solutions for medical devices, sterile packaging and other highly engineered custom products.”

The company’s single-use and single-patient devices and components are used in a wide range of medical devices and packaging for minimally invasive surgery, infection prevention, surfaces and support, wound care, wearables, orthopedic soft goods and orthopedic implants.

UFP reported $504.4 million in revenue in 2024.

UFP did not immediately respond to Information Security Media Group’s request for additional details about the incident, including whether it involved ransomware encryption of the company’s IT systems and data.

Supply Chain Threats

Cyber disruptions and breaches involving third-party makers, vendors and distributors of mission-critical healthcare products and services – from blood supplies to medical devices and other vital products – remain a top concern for the healthcare sector.

“There is fragility in medical device and healthcare supply chains. The slightest disruptions slow patient care, where minutes can matter in life-or-death cases,” said Jeff Wichman, director of incident response at security firm Semperis.

This concern pressures more healthcare sector organizations to pay ransoms in the hope of restoring encrypted systems, he said. “Organizations should keep in mind that in 40% of ransomware attacks, companies received corrupted decryption keys or none,” he said.

“Today, no network or system is truly impenetrable, and disruptions are inevitable,” Wichman said. “The speed at which organizations can respond and recover is just as critical as the defenses in place to prevent an attack.”

From an attacker’s perspective, assaults on the healthcare supply chain are primarily about “economics and leverage,” said Eran Barak, co-founder and CEO of security firm MIND.

“A manufacturer or distributor operates revenue-generating, time-sensitive environments,” Barak said. “Production systems, logistics platforms and supplier networks are critical to downstream healthcare delivery.”

“If those systems are disrupted, the pressure to restore operations quickly is significant. That urgency can influence ransom negotiations,” he said.

Also, sometimes attacks are aimed at potentially stealing intellectual property, which is often the most strategic asset inside a medical device company, Barak said.

“These organizations invest heavily in R&D, engineering design, firmware development and regulatory documentation. Theft of that information can undermine competitive advantage, enable counterfeiting or accelerate a competitor’s product road map,” he said.

Unlike patient data, which is monetized quickly, IP theft can have long-term impact on valuation and market position. “For advanced device manufacturers operating globally, the exposure of proprietary designs and manufacturing processes is not just a financial issue. It is a strategic risk that can reshape competitive dynamics.”

In fact, medical device manufacturers check every box hackers look for in a potential victim, said Mick Coady, field CTO, at security firm Elisity.

That includes proprietary designs and FDA submission data worth years of R&D investment, production lines that hospitals depend on for patient care and networks where corporate IT plugs straight into manufacturing with almost nothing separating the two, he said.

“I’ve seen this exact scenario across dozens of healthcare and manufacturing engagements. When attackers hit an organization like UFP Technologies and disrupt billing systems, delivery labels and production operations, they aren’t just encrypting files. They’re threatening a supply chain that surgical teams and clinicians rely on daily.”