8-K: Surmodics Discloses Cyberattack, Reports Critical Systems Restored Amid Ongoing Recovery

Surmodics, Inc. announced a cyber incident involving unauthorized access to its IT systems, but reports critical systems are restored and customer operations remain uninterrupted.

Summary

• On June 5, 2025, Surmodics, Inc. discovered unauthorized access to certain information technology (IT) systems, leading to the unavailability of some systems and data.
• The company promptly initiated containment measures, including taking certain IT systems offline, and implemented its security incident response plan.
• Law enforcement has been notified, and the company is working with third-party IT experts to contain, assess, and remediate the incident.
• As of July 2, 2025, critical IT systems have been restored and IT data is being validated.
• Remaining IT systems and data are being restored and validated according to a recovery plan.
• Throughout the incident, the company has maintained the ability to accept customer orders and ship products without material interruption using alternative systems.
• Analysis of the scope and details of the accessed IT data is ongoing.
• To the company's knowledge, the threat actor has not released any company or third-party data, nor used it for fraudulent purposes.
• Surmodics maintains cyber insurance, which is expected to cover much of the related expenditures, subject to policy deductible and exclusions.

Sentiment

Score: 4

Explanation: While a cyber incident is negative, the company's prompt and effective response, including critical system restoration, no material operational interruption, and cyber insurance coverage, mitigates some of the negative impact. The ongoing analysis of data scope and potential future risks prevent a higher score.

Positives

• Critical IT systems have been successfully restored.
• IT data is currently being validated, indicating progress towards full recovery.
• The company has been able to accept customer orders and ship products without any material interruption, utilizing alternative systems.
• Law enforcement was promptly notified, and third-party IT experts were engaged for remediation.
• To the company's knowledge, no data has been released or used for fraudulent purposes by the threat actor.
• The company maintains cyber insurance, which is expected to cover a significant portion of the incident-related expenditures.

Negatives

• A third party gained unauthorized access to the company's IT systems.
• Certain IT systems and data were initially unavailable due to the cyber incident.
• The company is still in the process of restoring and validating its remaining IT systems and data.
• The full scope and details of the IT data accessed by the threat actor are still under analysis.
• The company remains subject to various risks stemming from the incident, including potential litigation and regulatory scrutiny.

Risks

• Any impairment of the integrity of the company's IT systems or data.
• Delays or difficulties in restoring the company's IT systems and data.
• The company's continued ability to use alternatives to its IT systems, if needed.
• The company's ability to process information collected while using alternatives to its IT systems and the integrity of that information.
• The adequacy of processes during the period of disruption of the company's IT systems.
• The results of the company's analysis of the scope and details of the IT data that the Threat Actor accessed.
• Release by the Threat Actor of any of the company's data, including third-party data held by the company, or the use of any such data for any fraudulent purposes.
• The actual coverage of the company's claims under its cyber insurance policy.
• Further impact of the Cyber Incident on the company's financial condition or results of operations.
• Diversion of management's attention from operations of the company to addressing the Cyber Incident.
• Potential litigation related to the Cyber Incident.
• Changes in customer behavior as a result of the Cyber Incident.
• Reputational risk related to the Cyber Incident.
• Regulatory scrutiny of the Cyber Incident.

Future Outlook

The company anticipates continued restoration and validation of its remaining IT systems and data according to a recovery plan. It expects its cyber insurance to cover a significant portion of the expenditures related to the incident. The company also continues to analyze the scope of accessed data and monitor for any data release or fraudulent use.

Management Comments

• The company promptly initiated containment measures and implemented its security incident response plan.
• The company has been able to accept customer orders and ship products without any material interruption using alternatives to its normal IT systems.
• To the company's knowledge, the Threat Actor has not released any of the company's data or used any such data for fraudulent purposes.
• The company expects its cyber insurance to cover much of its expenditures related to the Cyber Incident.

Industry Context

Cyber incidents, including unauthorized access and data breaches, represent a pervasive and escalating threat across all industries. Companies, particularly those in healthcare or technology sectors like Surmodics, are frequent targets due to the sensitive nature of data they handle and their reliance on complex IT infrastructure. Effective incident response, including prompt containment, expert engagement, and insurance coverage, is becoming a critical component of corporate resilience and risk management in the face of these widespread threats.

Comparison to Industry Standards

• The company's immediate response, including taking systems offline and engaging third-party IT experts, aligns with best practices for cyber incident containment and remediation.
• Notifying law enforcement is a standard and crucial step in managing cyber incidents, demonstrating adherence to regulatory and investigative cooperation norms.
• Maintaining cyber insurance is a common risk mitigation strategy, reflecting an industry-standard approach to financial protection against cyber-related losses.
• The ability to maintain customer order acceptance and product shipment without material interruption, even during a significant IT disruption, indicates robust business continuity planning, which is a key differentiator in effective incident response.

Legal Proceedings

• Potential litigation related to the Cyber Incident is identified as a risk.

Stakeholder Impact

• Shareholders: Potential for financial impact from uninsurable costs, diversion of management attention, and reputational risk.
• Customers: While no material interruption to orders/shipments, potential for changes in customer behavior due to security concerns.
• Employees: Diversion of management's attention to addressing the incident, potential impact on internal IT systems and workflows.

Next Steps

• Continued restoration and validation of remaining IT systems and data in accordance with a recovery plan.
• Ongoing analysis of the scope and details of the IT data that the Threat Actor accessed.
• Monitoring for any release of company or third-party data by the Threat Actor or its use for fraudulent purposes.

Key Dates

Keywords

cyber incident, cybersecurity, data breach, IT systems, unauthorized access, data security, risk management, SEC filing, Form 8-K, Surmodics