Patient Monitor Manufacturer Is Still Recovering From Attack

A cyberattack against on-premises systems is affecting product manufacturing, fulfillment and distribution operations of Masimo, a manufacturer of patient monitoring devices, the California-based company told the U.S. Securities and Exchange Commission on Tuesday.

See Also: Top 10 Technical Predictions for 2025

Masimo submitted the report to the SEC along with a separate filing about the company’s 2025 first quarter financial results. During an earnings call with Wall Street financial analysts on Tuesday night, Masimo CEO Katie Szyman referenced the incident, saying that it has affected the company’s website and several of its IT systems since last week.

“The investigation is ongoing, but as of right now, we do not expect that this will have an impact on our guidance,” she told analysts. “We voluntarily filed a Form 8-K with the SEC around this situation, and you can refer to that for further details. Given the nature of these things, we appreciate your understanding that we will not be commenting more on this event during our earnings call today.”

In its filing with the SEC, Irvine, California-based Masimo said that on April 27, the company identified unauthorized activity on its on-premises network.

“Upon detection, we activated our incident response protocols and implemented containment measures, including proactively isolating impacted systems,” Masimo said.

“We promptly commenced an investigation and are actively working to assess, mitigate and remediate the incident with the assistance of third-party cybersecurity professionals,” Masimo said, adding that the company has also notified law enforcement about the incident.

Masimo, which reported nearly $2.1 billion in consolidated revenue in 2024, is a global manufacturer and developer of a wide array monitoring technologies such as blood oxygen saturation and pulse rate monitoring, noninvasive blood constituent, brain and breath monitoring and remote patient monitoring systems. Masimo products are used by hospitals, emergency medical service providers, physician offices, veterinarians, long-term care facilities and consumers.

Because of the incident, some Masimo manufacturing facilities have been operating at less-than-normal levels, the company said.

This has temporarily affected Masimo’s ability to process, fulfill and ship customer orders in a timely manner. “The company has been working diligently to bring the affected portions of its network back online, restore normal business operations and mitigate the impact of the incident.”

The investigation is ongoing, and the full scope, nature and impact of the incident are not yet known, Masimo said. “At this time, the company believes that the incident appears unrelated to and is not affecting the company’s cloud-based systems.”

Masimo declined Information Security Media Group’s request for additional details about the incident, including whether it involved ransomware. “We don’t have anything to add beyond this and the 8-K,” a Masimo spokesperson told ISMG.

If a cyberattack disrupts manufacturing and distribution at a med-tech company, the immediate concern is continuity of supply – especially for hospitals depending on devices such as pulse oximeters, said Scott Weinberg, CEO of managed services firm Neovera.

Manufacturing Concerns

A cyber incident at a medical device maker also raises concerns about product integrity, he said, and whether software, calibration settings or embedded firmware could’ve been altered in the attack. “In this industry, a suspicion of compromised product safety can also trigger regulatory scrutiny,” he said.

While Masimo has not publicly stated the exact nature of the incident, given the disruption to manufacturing and order fulfillment, the attack potentially could involve ransomware, data exfiltration or a targeted intrusion aimed at operational disruption, said Phil Englert, vice president of medical devices at the Health Information Sharing and Analysis Center.

“It is not uncommon for interruptions in business functions to impact operational capabilities” of medical gear manufacturers, Englert said.

“Artivion, a major manufacturer of heart surgery devices, was crippled by a ransomware attack in November 2024 that encrypted files and exfiltrated data. The incident disrupted order processing and shipping, forcing the company to take several systems offline,” he said.

In July 2023, BioHealth, a manufacturer of insulin pumps, was hit by ransomware, leading to the encryption of its entire network, including research and development data, he said. “The attack halted production and distribution, causing shortages of insulin pumps in multiple markets.”

Healthcare sector organizations often utilize just-in-time sourcing to improve efficiencies, he said. In case of disruptive incidents such as cyberattacks, these companies should plan in advance, he said.

“Manufacturers supporting critical infrastructure can maintain resilience by implementing robust supply chain security measures, diversifying suppliers and ensuring strategic stockpiles of essential components,” he said.