A cyberattack has disrupted global operations at medical technology manufacturer Stryker, forcing employees in multiple countries offline and cutting access to core corporate systems.
The incident, which began on March 11, triggered widespread outages across the company’s Microsoft environment, leaving staff temporarily unable to access internal applications and devices.
“When a company the size of Stryker experiences a global outage tied to a cyber incident, the immediate concern is not just whether data was taken but whether critical systems can still operate safely,” Ross Filipek, CISO at Corsica Technologies, said in an email to eSecurityPlanet.
Andrew Costis, engineering manager of the Adversary Research Team at AttackIQ, added, “The reported disruption at Stryker highlights how cyber operations tied to geopolitical tensions can quickly spill into the private sector, especially when the victim organization sits in a critical industry like healthcare.”
Steve Povolny, VP of AI Strategy & Security Research at Exabeam, noted in an email to eSecurityPlanet:
“The suspected Iran-linked cyberattack against Stryker represents a meaningful escalation in the geopolitical cyber playbook. Rather than targeting obvious government or defense infrastructure, the incident appears to hit a major medical technology provider whose products sit deep inside hospital operations worldwide.”
He explained, “That choice matters. Healthcare technology companies occupy a gray zone in cyber conflict; they are civilian entities, but their disruption can cascade into national resilience and public safety.”
Inside the alleged wiper attack on Stryker
Stryker is one of the world’s largest medical technology companies, manufacturing a wide range of surgical, orthopedic, and neurotechnology equipment used in hospitals and healthcare systems globally.
Because the company supplies critical medical devices used in patient care, disruptions to its internal systems can have ripple effects across healthcare providers, hospital networks, and global supply chains.
Responsibility for the attack has been claimed by Handala, a hacktivist group believed by security researchers to have links to Iran’s Ministry of Intelligence and Security (MOIS).
According to reporting by BleepingComputer, the group alleges it infiltrated Stryker’s network, exfiltrated roughly 50 terabytes of data, and then launched a destructive operation designed to wipe large portions of the company’s infrastructure.
In statements posted online, the attackers claim more than 200,000 systems, servers, and mobile devices were erased during the operation and that offices in 79 countries were forced offline. While those claims have not been independently verified, the company has confirmed the widespread operational disruption, and employees in multiple regions have corroborated it.
Employees report devices wiped and systems reset
According to individuals who identify themselves as Stryker employees, the incident appears to have begun early Wednesday morning, when devices enrolled in the company’s mobile device management (MDM) platform were suddenly reset or wiped.
Employees in the United States, Ireland, Costa Rica, and Australia reported that corporate laptops and mobile devices lost access to company services overnight after being remotely reset.
In some cases, employees who had enrolled personal smartphones to access corporate email or collaboration tools also saw their devices wiped after the remote reset commands were issued.
Staff were later instructed to remove corporate device management and applications from personal phones, including the Microsoft Intune Company Portal, Microsoft Teams, and VPN clients.
The disruption quickly spread beyond individual devices. Numerous employees reported losing access to internal applications, authentication systems, and network resources used for daily operations. At several locations, teams were forced to temporarily revert to manual pen-and-paper workflows after digital systems became unavailable.
The attackers also reportedly defaced Stryker’s Microsoft Entra login portal with imagery associated with the Handala group. Website defacement is a common tactic used by hacktivist groups to publicly signal responsibility for an intrusion and amplify the political messaging behind an attack.
Despite the group’s claims that destructive wiper malware was used, Stryker’s disclosure to the SEC states that the company currently has “no indication of ransomware or malware” present in its environment and believes the incident has been contained.
The company is continuing to investigate the root cause of the disruption with assistance from external cybersecurity experts while working to restore affected systems.
Must-read security coverage
- UK Police Convicts Pair in £5.5 Billion Bitcoin Launder Case
- Blackpoint Cyber vs. Arctic Wolf: Which MDR Solution is Right for You?
- How GitHub Is Securing the Software Supply Chain
- 8 Best Enterprise Password Managers
Building resilience against destructive cyberattacks
To defend against disruptive attacks from hacktivist groups and other threat actors, organizations should implement layered security controls that protect identity systems and endpoints.
- Maintain offline, immutable backups to enable rapid recovery from destructive attacks, such as wiper malware.
- Enforce multi-factor authentication, privileged access management, and strict role-based access controls for identity and device management systems.
- Segment identity services, endpoint management platforms, and production networks to limit the blast radius of a compromise.
- Monitor for abnormal administrative activity such as mass device wipes, bulk account resets, or large-scale configuration changes.
- Deploy endpoint detection and response (EDR) and identity threat detection tools to identify destructive activity and credential misuse.
- Strengthen logging and monitoring across identity systems, cloud services, and device management platforms to improve investigation and containment.
- Regularly test incident response and operational continuity plans to ensure organizations can quickly contain attacks and maintain essential operations during system outages.
Together, these steps help organizations build operational resilience and reduce the blast radius of a compromise by limiting attacker movement and enabling faster detection, containment, and recovery.
Editor’s note: This article originally appeared on our sister website, eSecurityPlanet.