Breach taxonomy
Summary
On June 5, 2025, Surmodics, Inc. discovered that a threat actor had gained unauthorized access to certain of its IT systems, rendering certain systems and data unavailable. The company initiated containment measures including proactively taking IT systems offline and implemented its security incident response plan. Law enforcement was notified. By the filing date, critical IT systems had been restored and the company was able to accept customer orders and ship products throughout the incident without material interruption using alternative systems. Filed under Item 8.01.
Tagging rationale
ThreatUnknown
Filing does not attribute the incident to a specific actor → UNKNOWN.
MethodsMalware
Unauthorized access rendered IT systems and data unavailable, requiring proactive system shutdowns and triggering incident response — consistent with malware deployment → MALWARE.