editorially independent. We may make money when you click on links
to our partners.
Learn More
A cyberattack has disrupted global operations at medical technology manufacturer Stryker, forcing employees in multiple countries offline and cutting access to core corporate systems.
The incident, which began March 11, triggered widespread outages across the company’s Microsoft environment and left staff temporarily unable to access internal applications and devices.
“When a company the size of Stryker experiences a global outage tied to a cyber incident, the immediate concern is not just whether data was taken but whether critical systems can still operate safely,” said Ross Filipek, CISO at Corsica Technologies in an email to eSecurityPlanet.
Andrew Costis, Engineering Manager of the Adversary Research Team at AttackIQ added, “The reported disruption at Stryker highlights how cyber operations tied to geopolitical tensions can quickly spill into the private sector, especially when the victim organization sits in a critical industry like healthcare.”
“The suspected Iran-linked cyberattack against Stryker represents a meaningful escalation in the geopolitical cyber playbook. Rather than targeting obvious government or defense infrastructure, the incident appears to hit a major medical technology provider whose products sit deep inside hospital operations worldwide,” said Steve Povolny, Vice President of AI Strategy & Security Research at Exabeam in an email to eSecurityPlanet.
He explained, “That choice matters. Healthcare technology companies occupy a gray zone in cyber conflict; they are civilian entities, but their disruption can cascade into national resilience and public safety.”
Inside the Alleged Wiper Attack on Stryker
Stryker is one of the world’s largest medical technology companies, manufacturing a wide range of surgical, orthopedic, and neurotechnology equipment used in hospitals and healthcare systems globally.
Because the company supplies critical medical devices used in patient care, disruptions to its internal systems can have ripple effects across healthcare providers, hospital networks, and global supply chains.
Responsibility for the attack has been claimed by Handala, a hacktivist group believed by security researchers to have links to Iran’s Ministry of Intelligence and Security (MOIS).
According to reporting by BleepingComputer, the group alleges it infiltrated Stryker’s network, exfiltrated roughly 50 terabytes of data, and then launched a destructive operation designed to wipe large portions of the company’s infrastructure.
In statements posted online, the attackers claim more than 200,000 systems, servers, and mobile devices were erased during the operation and that offices in 79 countries were forced offline.
While those claims have not been independently verified, the widespread operational disruption has been confirmed by the company and corroborated by reports from employees in multiple regions.
According to individuals identifying themselves as Stryker employees, the incident appears to have begun early Wednesday morning when devices enrolled in the company’s mobile device management (MDM) platform were suddenly reset or wiped.
Employees in the United States, Ireland, Costa Rica, and Australia reported that corporate laptops and mobile devices lost access to company services overnight after the devices were remotely reset.
In some cases, employees who had enrolled personal smartphones to access corporate email or collaboration tools also saw their devices wiped after the remote reset commands were issued.
Staff were later instructed to remove corporate device management and applications from personal phones, including the Microsoft Intune Company Portal, Microsoft Teams, and VPN clients.
The disruption quickly spread beyond individual devices. Numerous employees reported losing access to internal applications, authentication systems, and network resources used for daily operations.
At several locations, teams were forced to temporarily revert to manual pen and paper workflows after digital systems became unavailable.
The attackers also reportedly defaced Stryker’s Microsoft Entra login portal with imagery associated with the Handala group.
Website defacement is a common tactic used by hacktivist groups to publicly signal responsibility for an intrusion and amplify the political messaging behind an attack.
Despite the group’s claims that destructive wiper malware was used, Stryker’s disclosure to the SEC states that the company currently has “no indication of ransomware or malware” present in its environment and believes the incident has been contained.
The company is continuing to investigate the root cause of the disruption with assistance from external cybersecurity experts while working to restore affected systems.
Building Resilience Against Destructive Cyberattacks
To defend against disruptive attacks from hacktivist groups and other threat actors, organizations should implement layered security controls that protect identity systems and endpoints.
- Maintain offline and immutable backups to enable rapid recovery from destructive attacks such as wiper malware.
- Enforce multi-factor authentication, privileged access management, and strict role-based access controls for identity and device management systems.
- Segment identity services, endpoint management platforms, and production networks to limit the blast radius of a compromise.
- Monitor for abnormal administrative activity such as mass device wipes, bulk account resets, or large-scale configuration changes.
- Deploy endpoint detection and response (EDR) and identity threat detection tools to identify destructive activity and credential misuse.
- Strengthen logging and monitoring across identity systems, cloud services, and device management platforms to improve investigation and containment.
- Regularly test incident response and operational continuity plans to ensure organizations can quickly contain attacks and maintain essential operations during system outages.
Together, these steps help organizations build operational resilience and reduce the blast radius of a compromise by limiting attacker movement and enabling faster detection, containment, and recovery.
Geopolitical Cyberattacks Move Into the Private Sector
The Stryker incident reflects a broader trend in which geopolitically motivated cyber activity is increasingly affecting private sector organizations, not just government agencies.
Unlike ransomware campaigns that primarily seek financial gain, wiper-style attacks are typically intended to disrupt systems and operations.
Healthcare and medical technology companies can be particularly sensitive to these types of incidents because their operations depend on reliable access to data, connected systems, and global supply chains.
These types of incidents are also driving organizations to adopt zero trust solutions, which help limit lateral movement.
