How a "Limited" Cyber Intrusion Triggered a Global Medical Device Shutdown

Earlier this year, a global medical device manufacturer detected a cyber intrusion. Within days, the company’s operations began to lag worldwide. 

What the Investigation Found

The company’s forensic investigation found that the threat actor had compromised an external network device and then reached “a limited portion” of the on-premises IT environment. Activity ceased once containment efforts took hold. Investigators found the cloud and industrial control environments uncompromised.

The media nonetheless reported a global disruption. Employees at a European manufacturing site were sent home because they could not work, and critical internal information systems became inaccessible across the company, causing major operational outages worldwide. 

The Financial Consequences Arrived Within Two Weeks

Within two weeks, the company filed a second Form 8-K with the SEC confirming that the incident was likely to have a material impact on corporate results for the third quarter and the remainder of the year.

Net sales growth and adjusted EPS were unlikely to land within guidance ranges that the company had issued only about a month before the attack, although the company did not expect an impact on its long-term financial condition.

The filing also acknowledged that the outage affected the company’s ability to manufacture physical products and ship customer orders.

How a Medical Device Outage Reaches Patients

For a medical device maker, a missed shipment carries consequences well beyond a missed quarter. As Jacob Krell of Suzu Labs phrased it “A cardiac device that misses its ship date can mean a cancelled surgery.”

Hospitals schedule procedures around specific devices, coordinating inventory and orders in advance. When manufacturing and order processing stall, the disruption ripples through healthcare systems, affecting clinicians, hospitals, and patients.

How the Scope of an Outage Can Exceed the Scope of an Intrusion

A disruption to one system can halt dependent operations, even when dependent systems haven’t been compromised. When responders can’t verify system integrity, they take additional systems offline until they can establish which are safe to operate. The resulting outage can extend well beyond the attacker’s reach.

In medical manufacturing, restarting production requires teams to confirm the integrity of production and quality records and ensure affected processes meet regulatory requirements. Such system checks add time between containing an attack and getting the manufacturing line running again.

In the first days of an incident, defenders need to know which systems the attacker accessed and which were left untouched. Establishing the scope or “blast radius” of an intrusion helps responders contain the threat with as few unnecessary shutdowns as possible, allowing for faster production restoration. 

How Network Visibility Helps Responders Isolate Only What’s Affected

Threat actors can tamper with logs and disable endpoint agents, but their movements still leave traces within network traffic. In pharmaceutical and medical device manufacturing, where IT, laboratory, production, and quality systems are interconnected — and much equipment cannot run endpoint agents — network activity helps investigators trace an intrusion and identify which systems communicated with a compromised device.

ExtraHop decrypts and analyzes network traffic in real time, showing investigators which systems communicated with a compromised device, when those connections occurred, which protocols they used, and whether the attacker attempted to reach additional systems.

With ExtraHop, the east-west traffic record shows whether the compromised device ever reached production or laboratory segments; teams can prove shop-floor systems were untouched rather than shutting them down as a precaution.

ExtraHop’s network evidence helps responders distinguish systems the attacker reached from systems that remain unaffected, enabling more targeted containment. The OT Activity dashboard enables teams to rapidly visualize and monitor OT protocol activity across network traffic, streamlining the troubleshooting of outages and abnormal behavior. ExtraHop provides regulatory teams a time stamped record of observed activity to support recovery decisions and revalidation through continuous, passive network analysis rather than active scanning.

As SOC teams adopt autonomous response, agents need network context to understand the activity behind an alert before taking action. By showing how an attacker moved through the environment, ExtraHop helps agents and analysts assess the scope of an intrusion and make more precise containment decisions.

Learn more about how to build an agentic SOC in A CISO’s Guide to Agentic AI Adoption.