Company: BSX
Filing Date: 2025-02-18
Form Type: 10-K
Source: 0000885725-25-000011
Chunk: 40

Company: BOSTON SCIENTIFIC CORP
Filing Date: 2025-02-18
Form: 10-K
Item: Item 1A
Chunk 40
---
 operations and our financial results.

Our information systems require an ongoing commitment of significant resources to maintain, protect and enhance existing systems and develop new systems to keep pace with continuing changes in information processing technology, evolving systems and regulatory standards, the increasing need to protect patient and customer information and changing customer patterns. This includes opportunities as well as risks associated with the integration of AI into our or our suppliers' or customers' operations. While AI presents significant opportunities for innovation and efficiency, it could introduce new risks in managing information systems and in the cybersecurity threat landscape. In addition, third parties have and may continue to attempt to hack into our products to obtain data relating to patients, or alter the intended functionality of our medical devices, or disrupt performance of our products, or access our proprietary information and the technology from third party vendors that we rely upon may have defects or vulnerabilities which, in turn, create vulnerabilities or disruptions in our system. Cyber-attacks continue to evolve in complexity and scope, and inherently may be difficult to detect. This includes emerging technologies which increase our threat landscape, such as generative AI and quantum computing, which are evolving rapidly in their practicality and use for cyber-attacks including through enhanced social engineering, and for cyber-attacks on industry standard data protections through increased computing capabilities. We have seen, and could continue to see, software and supply-chain vulnerabilities and malware, which could affect our systems and the systems of our third-party vendors and business partners. Some of our IT and OT systems contain legacy third-party software components for which we depend on a layered security approach to protect against exploitation, and such layered security approach may not be effective. Any failure by us to maintain 

24

or protect our IT or OT systems, products and data integrity, including from cyber-attacks, intrusions or other breaches, could result in outages or unauthorized access to patient data and personally identifiable information, theft of intellectual property or other misappropriation of assets, or otherwise compromise our confidential or proprietary information and disrupt our operations, or, in the worst case, could result in harm to patients. In addition, such attackers may make demands for ransom, which could result in financial loss, or, if we determine not to pay such ransom, other harm, loss, or misappropriation of our data and assets. Such failure, or demonstration of vulnerability to such failure, may also result in additional regulatory scrutiny. We also grow our company through acquisitions and may face risks associated with defects and vulnerabilities in acquired systems as we work to integrate the acquisitions into our IT system.