Surmodics confirms cyberattack, says critical systems restored as investigation continues

Surmodics Inc., a Minnesota-based medical technology firm, reported on Wednesday that it is still recovering from a cyberattack that struck its IT systems on June 5. The incident, which forced the company to take parts of its infrastructure offline, is under active investigation by law enforcement and cybersecurity experts.

The company, which supplies hydrophilic coatings used in intravascular medical devices, disclosed the breach in a filing with the U.S. Securities and Exchange Commission. Surmodics said that an unauthorized third party accessed certain IT systems and data, prompting an immediate response that included system shutdowns and activation of a security incident protocol.

Although the company was able to continue accepting customer orders and shipping products through alternative channels, the full extent of the data breach is still being analyzed. “The scope and details of the IT data impacted by the cyber incident are currently under review,” said Surmodics CFO Timothy Arens in the SEC filing. He noted that while critical IT functions have been restored, additional systems and data are still undergoing recovery and validation.

Surmodics emphasized that, to its knowledge, no internal or third-party data has been publicly released or misused. The company also confirmed that it holds cyber insurance and expects most of the costs tied to the incident to be covered, subject to policy terms.

However, Arens acknowledged that the attack poses ongoing risks to the company, including operational disruption, potential litigation, regulatory scrutiny, and changes in customer behavior. In recent months, similar breaches at other companies have triggered class action lawsuits, raising concerns about the broader legal exposure for firms experiencing cybersecurity incidents.

The attack places Surmodics among a growing list of publicly traded medical device manufacturers targeted by cybercriminals, following earlier disclosures from Artivion and Masimo. Despite the breach, Surmodics reported no material interruption in customer service.

The news comes as the company prepares to release its next earnings report on July 30. In its most recent quarter, Surmodics reported $28 million in revenue and continues to maintain a strong financial position, with current assets far exceeding short-term liabilities.

Separately, Surmodics is involved in a high-profile federal antitrust case with the Federal Trade Commission, which is seeking to block a proposed $627 million acquisition of the company by a private equity firm. The FTC argues the deal would consolidate the two largest producers of medical device coatings in the U.S.