Iran-linked Handala group claims wiper attack that crippled Stryker worldwide
Stryker, one of the world's largest medical technology companies, said on March 11 that a cyberattack had caused a global disruption to its Microsoft environment, after employee laptops and phones enrolled in its device management system were remotely wiped. The pro-Iran group Handala claimed responsibility.
The attack stands out because it was destructive rather than a typical ransomware extortion. Stryker employs more than 53,000 people and sells surgical equipment, implants and hospital beds around the world, so a prolonged outage could ripple into hospital supply chains.
What happened
Employees told BleepingComputer the incident began early on the morning of March 11, when managed Windows and mobile devices, including personal phones enrolled for work access, were wiped overnight. Stryker's sign-in page was defaced with Handala's logo. Staff in the United States, Ireland, Costa Rica and Australia reported problems, and some sites reverted to pen and paper. Employees were told to remove the company portal, Teams and VPN apps from personal devices.
In a filing with the U.S. Securities and Exchange Commission, Stryker said it had no indication of ransomware or malware and believed the incident was contained. It gave no timeline for full restoration. A spokesperson told TechCrunch the company was restoring systems.
Handala claimed on X that it had wiped more than 200,000 systems, servers and mobile devices, stolen 50 terabytes of data and forced offices in 79 countries to shut. It framed the attack as retaliation linked to the conflict with Iran. Those figures have not been independently verified.
Who is behind it
Palo Alto Networks' Unit 42 assesses Handala as a persona tied to Iran's Ministry of Intelligence and Security. The acting director of the U.S. Cybersecurity and Infrastructure Security Agency, Nick Andersen, said the agency was investigating. Reporting cited by BleepingComputer suggests the attackers abused the company's own device management tools to issue remote wipe commands, rather than deploying conventional malware.
What we don't know yet
Stryker has not said whether customer or patient data was taken, how the attackers gained administrative access, or how long recovery will take.
What to do
Organizations that manage devices through cloud tools such as Microsoft Intune should require phishing-resistant multi-factor authentication for administrators, limit who can issue bulk wipe commands and require a second approver for destructive actions.
