How a 'Limited' Cyber Intrusion Triggered a Global Medical Device Shutdown
ExtraHop, Friday, November 6th, 2026
ExtraHop examines how a limited intrusion at a medical device maker led to a global shutdown and how network evidence aids containment.
A global medical device manufacturer detected an intrusion in which an attacker compromised an external network device and reached a limited portion of its on-premises IT environment, while cloud and industrial control systems were not compromised.
Operations were still disrupted worldwide, employees at a European site were sent home, and the company filed a second Form 8-K saying the incident would likely materially affect results for the rest of the year.
The outage hit manufacturing and shipping, which can delay surgeries that depend on specific devices.
ExtraHop argues that when responders cannot verify system integrity they take more systems offline, and network evidence helps them contain only what is actually affected.