Medical device company Surmodics reports cyberattack, says it’s still recovering

Minnesota-based company Surmodics said a cyberattack on June 5 forced the medical device manufacturer to shut down parts of its IT system.

Surmodics is the largest U.S. provider of outsourced hydrophilic coatings used to reduce friction for objects such as intravascular medical devices. Last month its IT team discovered unauthorized access in its network and took systems offline, while using alternative methods to accept customer orders and ship products.

Law enforcement has been notified, according to a filing with the U.S. Securities and Exchange Commission (SEC). 

The company is the third publicly traded medical device company to report a cyberattack to the SEC after Artivion and Masimo filed documents in December and May, respectively. 

Surmodics said it has partially recovered from the attack with the help of cybersecurity experts but the “scope and details of the IT data” stolen by the hackers are still being analyzed. While “critical” IT systems have been restored, some systems and data are still being worked on. 

“The Company remains subject to various risks due to the cyber Incident, including the adequacy of processes during the period of disruption of the Company's IT systems, diversion of management's attention, potential litigation, changes in customer behavior, and regulatory scrutiny,” Surmodics CFO Timothy Arens told the SEC. 

The hackers behind the attack have not come forward, but Surmodics said no company data or third-party information it holds has been released. 

Surmodics has cyber insurance, which the company expects will cover most of the costs associated with the cyberattack. 

Surmodics’ concern about potential litigation comes as companies increasingly face class action lawsuits related to data breaches or cyberattacks that expose employee information. In recent weeks, class action lawsuits have been filed against companies like Coinbase and Krispy Kreme over breaches that saw hackers access sensitive data. 

The company reported $28 million in revenue last quarter but is in the midst of a federal court case filed by the Federal Trade Commission centered around a private equity firm’s attempt to purchase Surmodics for $627 million. The FTC is attempting to stop the sale because it would effectively combine the two largest manufacturers of critical medical device coatings.