Cybersecurity has long been a background risk for healthcare companies. Last week, it moved firmly into the foreground.
Two separate incidents — a major cyberattack disrupting operations at orthopaedics giant Stryker Corp (NYSE:SYK) and a phishing breach at surgical robotics leader Intuitive Surgical Inc (NASDAQ:ISRG, XETRA:IUI1) — have underscored how exposed the sector has become as it leans further into connected devices, cloud-based systems and digital workflows.
Healthcare groups are investing heavily in data, AI-driven tools and integrated device ecosystems. But those same advances are widening the attack surface — and, increasingly, the consequences are spilling beyond IT departments into real-world patient care.
Operational disruption hits Stryker
Stryker’s incident has been the more severe of the two, affecting internal systems tied to order processing, shipping and device management.
In a March 11 message to customers, the company confirmed it had taken systems offline in response to a cybersecurity event, triggering disruptions to product availability and logistics. Subsequent updates suggested it was gradually restoring affected services.
External reporting indicates the impact ran deeper. Some hospitals experienced delays in receiving critical surgical supplies, with knock-on effects for procedures. That moves the issue from a corporate IT problem into a clinical one — a distinction regulators and investors are increasingly focused on.
While details of the attack vector remain limited, cybersecurity analysts have pointed to the growing sophistication of state-linked and financially motivated threat actors targeting healthcare infrastructure. The sector’s combination of valuable data, operational urgency and historically uneven cyber defences makes it an attractive target.
Phishing breach highlights softer entry points
Intuitive Surgical’s incident, by contrast, appears more contained — but no less instructive.
The company disclosed on March 13 that an employee had been targeted in a phishing attack, allowing unauthorised access to certain internal systems. There has been no indication of disruption to its core robotic surgery platforms, including the widely used da Vinci system.
Still, the breach highlights a persistent vulnerability: human error.
Even as companies harden networks and deploy advanced detection tools, phishing remains one of the most effective ways for attackers to gain a foothold. In highly interconnected environments — where clinical systems, customer data and device software are often linked — even limited access can pose broader risks.
A sector-wide risk, not isolated events
Taken together, the two incidents illustrate different ends of the same spectrum: from targeted credential theft to system-wide operational disruption.
They also reinforce a broader trend flagged by industry analysts — that cyberattacks in healthcare are no longer occasional shocks, but a structural feature of the operating environment.
Consultants and security specialists increasingly describe attacks as “inevitable”, particularly as geopolitical tensions and AI-enabled tools accelerate both the scale and sophistication of threats. Healthcare systems, medical device manufacturers and biotech firms are all part of that expanding risk landscape.
For medtech companies, the challenge is especially acute. Products are no longer standalone devices; they are part of digital ecosystems that include cloud connectivity, software updates and data analytics platforms. Each connection point introduces potential vulnerabilities.
Implications for biotech and medtech investors
For investors, the immediate question is whether these events translate into financial or regulatory fallout.
In Stryker’s case, the operational disruption raises the prospect of short-term revenue impacts, remediation costs and reputational damage, particularly if hospitals reassess supplier reliability. The longer-term issue is whether such incidents prompt stricter regulatory scrutiny around device cybersecurity and resilience.
Stryker’s shares fell as much as 6% in the aftermath of the attack, contributing to a more than 8% slide over the past month.
For Intuitive Surgical, the limited nature of the breach suggests minimal near-term financial impact. But it reinforces the need for ongoing investment in employee training, access controls and incident response capabilities — areas that are becoming standard expectations rather than optional extras.
Shares in Intuitive are also subdued, down nearly 3% since the phishing disclosure and nearly 5% over the past month.
More broadly, cybersecurity is shifting from a cost centre to a core component of competitive positioning.
Companies that can demonstrate robust, resilient systems — and maintain continuity of care even during an attack — may gain an edge with hospital customers and regulators alike. Conversely, repeated or poorly managed incidents could weigh on valuations, particularly in a market already sensitive to execution risk.
From IT issue to clinical priority
The bigger shift is conceptual.
Cybersecurity in healthcare is no longer just about protecting data; it is about safeguarding operations, supply chains and, ultimately, patient outcomes.
As hospitals and device makers become more digitally integrated, the line between cyber risk and clinical risk continues to blur. A delayed shipment, a locked system or a compromised network can now have direct implications for treatment timelines and surgical capacity.
That reality is likely to drive further investment across the sector — not only in defensive technologies, but also in system redundancy, supply chain flexibility and crisis response planning.
For biotech and medtech companies navigating an increasingly complex operating environment, the message is clear: innovation may still drive growth, but resilience will determine who can sustain it.