CISA urges companies to secure Microsoft Intune systems after hackers mass-wipe Stryker devices

CISA has issued guidance urging organizations to harden their endpoint device management systems after pro-Iran hacktivist group Handala breached medical tech company Stryker and used access to its Microsoft Intune dashboards to remotely wipe tens of thousands of employee devices. CISA recommends requiring dual-administrator approval for high-impact actions like device wipes. Stryker confirmed the attack on March 11, noting no ransomware was deployed but that supply, ordering, and shipping systems remain offline. The FBI has since seized Handala's website.