Medical Device Maker Surmodics Recovering from Attack

A Minnesota maker of catheters notified federal regulators it is recovering from a cyberattack discovered in early June that rendered a portion of its IT systems and data inaccessible.

See Also: New Attacks. Skyrocketing Costs. The True Cost of a Security Breach.

Surmodics, which also manufacturers diagnostic tests, drug delivery coatings and other specialty medical device products in a Wednesday filing with the U.S. Securities and Exchange Commission did not specifically mention ransomware. The company, whose surface modification technology is used for more than 150 commercial medical device product offerings, reported $33.2 million in revenue during 2024.

Surmodics said it discovered on June 5 that threat actors gained unauthorized access to some IT systems “and that certain IT systems and data were unavailable to the company,” an indicator typical of cryptolocking malware used by ransomware gangs.

The company said critical IT systems are again working and data is undergoing validation checks. The rest of Surmodics’ IT systems and data are being restored and validated “in accordance with a recovery plan,” the company said.

The attack didn’t prevent the company from accepting orders and shipping products by recourse to “alternatives to its normal IT systems.”

The medical device technology maker expects its cyber insurance to cover much of the costs related to the incident. It did not immediately respond to Information Security Media Group’s request for additional details about the cyberattack.

The Surmodics is among a handful of other medical device product makers disclosing cyberattacks in recent months.

That includes California-based Masimo, a manufacturer of patient monitoring devices, which reported on May 6 that a cyberattack against on-premises systems affected its product manufacturing, fulfillment and distribution operations (see: Patient Monitor Manufacturer Still Recovering From Attack).

In another filing later that month, Masimo said it did not expect the cybersecurity incident to materially impact the company’s revenue or to prevent it from fulfilling customer orders.

Masimo also said it expected that the majority of out-of-pocket remediation costs incurred by the incident will be covered by its cyber insurance.

Besides those attacks, in December, U.S. cardiac and vascular implantable devices maker Artivion also reported to regulators a cybersecurity incident involving data encryption and theft.

The hack, discovered on Nov. 21, disrupted order processing, shipping and corporate operations, but had largely been resolved at the time of the company’s SEC filing (see: Breach Roundup: Kosovar Illicit Marketplace Rydox Shuttered).