Masimo manufacturing cyber incident

Analyst assessment

An April 2025 network intrusion at Masimo Corp., a medical-device manufacturer based in Irvine, California, disrupted production and customer orders. The company’s May 6 filing dates detection to April 27 and describes unauthorized activity on its on-premises network. Masimo isolated affected systems and engaged outside specialists. Its own disclosure provides high confidence in cyber involvement and the resulting operational disruption.

The evidence supports reduced production at certain facilities, rather than a shutdown of every factory. April 27 is the known detection date; the public record does not establish how long an intruder had been present. Masimo said it notified law enforcement, without identifying a particular agency.

Operational significance

The intrusion impaired timely processing, fulfillment and shipment of orders. Cybersecurity Dive also reported CEO Katie Szyman’s account of disruption to the website and several computer systems. These effects affected the company’s ability to manufacture and deliver products; the reviewed evidence does not establish failures of deployed hospital devices or interruption of patient care.

Recovery proceeded in stages. In its May 27 update, Masimo reported near-full manufacturing capacity and fully operational critical order-taking, distribution and shipping systems. It was still optimizing systems to process delayed orders. That update establishes substantial recovery, without a complete manufacturing all-clear.

The company’s quarterly report filed Aug. 5 states that all manufacturing had returned to normal by June 28. That positive recovery evidence supports a resolved operational status. The exact final restoration day is not established.

Confidence and uncertainty

Masimo initially believed its cloud-based systems were unrelated to and unaffected by the intrusion. That was a qualified assessment during an investigation, not a comprehensive finding about every system or data category. Fierce Medtech’s May 6 report also described no current evidence of employee or patient data compromise. The linked initial filing does not make that data finding, and the reviewed record does not establish a final data-compromise scope.

The quarterly report recorded about $4.5 million in cybersecurity-related selling, general and administrative expense, net, for the quarter ended June 28, including about $1 million in insurance reimbursement. This is a defined quarterly accounting measure, rather than the total economic cost of the incident. Later legal or financial developments do not extend the documented operational outage.

Analytic gaps

The evidence does not establish the entry route, malware family, encryption, ransom demand or payment. Ransomware involvement and responsibility for the April 2025 intrusion remain unresolved. A prolonged recovery or the involvement of law enforcement does not independently identify either.

The reviewed disclosures do not identify each affected manufacturing site, quantify delayed orders or establish downstream harm to a named customer. The corporate headquarters locates Masimo in Irvine, but does not establish that all affected production occurred there.