Boston Scientific Q3 2026: cyberattack held sales growth to 1.5%, GAAP EPS fell 22% to $0.40

Boston Scientific's third quarter of 2026 (three months to September 30) was the first one hit by the cyberattack the company detected on August 25. Sales rose only 1.5% to $5.14 billion, below the 3–5% organic growth it had guided to in July, before the attack. GAAP diluted EPS (earnings per share under standard accounting rules) fell 22% to $0.40. Adjusted EPS, management's measure that strips out amortization and one-off items, slipped 2.7% to $0.73, short of the $0.80–$0.82 guided in July. The bigger news is the outlook: the company now expects fourth-quarter sales to fall 1–3% from a year ago, so the revenue lost to the outage is not coming back this year.

This report is written from the earnings release (Exhibit 99.1 to the October 28 8-K). The full 10-Q is not filed yet, and the release does not break out Electrophysiology (the Farapulse heart-rhythm business) or Watchman, or explain why costs moved. We will update this analysis if the 10-Q changes the picture.

Key metrics

Gross margin is gross profit (sales minus the cost of making the products, before amortization) as a share of sales. Operating margin is the share of sales left after running the business, before interest and tax. Margins and the EPS change are our calculations from the release's statement of operations; the adjusted operating margin uses the company's non-GAAP reconciliation.

Takeaway: The cyberattack cost Boston Scientific most of a quarter's growth, and the guidance says the damage runs into Q4 rather than reversing. In September the company said it expected to recover "some portion" of the lost revenue as backlogs cleared; a guided Q4 sales decline of 1–3% means that recovery is not showing up this year. The weaker underlying gross margin (68.0% vs 71.0%) suggests the outage also raised costs, not just delayed orders. Until the 10-Q gives Electrophysiology and Watchman figures, there is no way to tell how much of the slowdown is the outage and how much is the competitive pressure in Farapulse that was already visible in Q2.

What happened in the quarter

The cyberattack. On August 25 the company detected unauthorized activity on its IT systems. Its September 8 8-K said the resulting network outage "impacted the Company's ability to manufacture as well as process and ship customer orders." Distribution centers and sterilization plants were running again by then and manufacturing had resumed at most sites, but the company warned it was "unlikely to meet" its July guidance. The release confirms that: CEO Mike Mahoney calls 2026 "a challenging year" and credits teams for working "to restore operations." The release gives no dollar estimate of revenue lost to the incident.

Sequentially the drop is sharper than the year-on-year figure suggests. Sales fell 5.6% from Q2's $5,442M. Cardiovascular fell 6.0% ($3,624M to $3,406M) and MedSurg 4.7% ($1,818M to $1,733M). Currency had no net effect on the quarter, and no acquisitions were excluded, so reported, currency-neutral and organic growth were all 1.5%.

Where the growth came from

• Neuromodulation (pain and movement-disorder implants) was the only business with strong growth, at 13.1%, close to Q2's 12.7%.
• Endoscopy went from +7.6% in Q2 to a slight decline, and Urology from +1.1% to -3.2%. Urology was already weak in Q2 from Chinese price tenders on kidney-stone products, per the Q2 10-Q.
• Cardiovascular, two-thirds of sales, grew 1.9%. The release does not split out Electrophysiology, Watchman, Interventional Cardiology or Cardiac Rhythm Management, so the products that drove the company's growth in 2024–2025 cannot be assessed until the 10-Q.

The US, 64% of sales, was nearly flat (+0.5%, vs +6.2% in Q2). Europe held up better at 6.1% excluding currency. Asia-Pacific swung from +11.2% in Q2 to a 1.1% decline. In Latin America and Canada, currency moves added about 5.5 points, so the 16.0% reported growth overstates the local-currency gain of 10.5%.

What the headline numbers hide

GAAP EPS fell eight times as fast as adjusted EPS. GAAP EPS dropped 22% and adjusted EPS 2.7%. The $0.33 gap between them breaks down as follows, per the company's reconciliation:

Amortization, the yearly write-off of the purchase price of technology the company bought, recurs every quarter and was nearly unchanged. Most of the swing is new charges. Restructuring was a $63M charge in the income statement, against an $8M credit a year ago; this is the 2026 plan approved in July, which the company said would cost $700–$800M through 2029. There was also an $81M litigation charge (none a year ago) and a $39M write-down of acquired technology. Together those three lines are $183M of pre-tax charges, against a $8M credit in Q3 2025. A $32M benefit from lowering expected earn-out payments on past acquisitions ("contingent consideration") partly offset them. Excluding these items is reasonable, but restructuring will recur for three more years, and this is the second straight quarter with a litigation charge ($76M in Q2), so GAAP results will keep trailing adjusted ones.

The adjusted figure is not clean either. Adjusted operating income fell 3.9% ($1,364M vs $1,419M), and adjusted net income 5.4% ($1,063M vs $1,124M). Adjusted EPS fell less than that, 2.7%, because diluted shares were 2.9% lower (1,452.0M vs 1,495.5M), mainly from the $2B accelerated share repurchase disclosed with Q2. Without the smaller share count, adjusted EPS would have fallen about as much as adjusted profit.

Costs rose while sales barely did. Cost of products sold rose 12.3% ($1,710M vs $1,523M), or 11.9% excluding special items. Adjusted gross margin fell 3.0 points to 68.0%. The release does not explain why. Our reading, which the 10-Q should confirm or correct, is that plants idled or slowed by the outage still carried their fixed costs and recovery work added expense. Operating spending was held down: SG&A (selling, general and administrative costs) was down 3.3% to $1,683M, and R&D was roughly flat at $520M (+1.2%). Interest expense rose 15% to $100M. The tax rate was 20.9%, against 19.5%, a small drag.

Cash flow and the balance sheet are not in the release, so cash conversion, inventory and receivables after the outage can't be checked until the 10-Q. That matters here: a quarter of disrupted shipping can leave inventory high and receivables lumpy.

Guidance has now been cut twice. In April, full-year organic growth was 6.5–8.0% and adjusted EPS $3.34–$3.41. July lowered that to 5–6% and $3.28–$3.32. Today's figures are ~3.75% and $3.16–$3.18. Nine-month adjusted EPS is $2.39, so the Q4 guide of $0.77–$0.79 is what fills the gap.

On balance the quarter is understated: GAAP EPS fell 22%, but $183M of restructuring, litigation and impairment charges (against an $8M credit a year ago) explain most of that, and adjusted EPS fell 2.7%. The outage itself is a real cost in both measures, and buybacks hid part of the adjusted decline.

Did last time's read hold up?

Our Q2 report expected Q3 to be hard to read because of the outage, and said to watch whether coronary-balloon and neuromodulation strength continued and how much lost revenue the company said it recovered. Neuromodulation held up (+13.1%). The release gives no coronary figure. On recovery, the answer is the opposite of a catch-up: a guided Q4 sales decline. The Q2 report's broader call, that growth in the core franchises was slowing before the attack, cannot yet be separated from the outage.

Outlook

Management's guidance (October 28):

• Q4 2026: sales down about 1–3% from a year ago on both a reported and organic basis; adjusted EPS $0.77–$0.79.
• Full year 2026: sales growth of about 4.25% reported and 3.75% organic; adjusted EPS $3.16–$3.18 (July: 5–6% organic, $3.28–$3.32).

The company does not give GAAP EPS guidance, saying it cannot predict impairments, acquisition, restructuring and litigation charges.

Our view. A Q4 sales decline at a company that grew 7.5% in Q2 means the outage either cost more lasting business than the September 8-K implied, or that the outage is masking slower underlying demand. Most likely it is some of both. Three things to watch in the 10-Q and in Q4:

1. Electrophysiology and Watchman growth in Q3, especially in the US, where Farapulse faced new pulsed-field competition in Q2 (pulsed-field ablation uses short electrical pulses to destroy the heart tissue that causes irregular rhythm). If they slowed by more than the company average, the problem is not only the outage.
2. Gross margin and inventory. If adjusted gross margin returns toward 70–71% in Q4, the Q3 drop was outage-related. If it stays near 68%, the cost structure has shifted.
3. Whether Q4 lands inside the guided range. It is the first guide issued after the attack, with full knowledge of the disruption, so a miss would be harder to explain.

The release does not update the pending $14.5B Penumbra acquisition.

Source: Boston Scientific earnings release for the quarter ended September 30, 2026 (Exhibit 99.1 to the Form 8-K filed October 28, 2026). Cyberattack details are from 8-Ks filed August 26 and September 8, 2026. Q2 comparisons, April/July guidance and the restructuring plan come from our Q2 2026 report and the filings it cites. Margins, sequential changes and the shortfall against July guidance are our calculations. The Q3 10-Q had not been filed when this was published.