<h2>What happened</h2>
<p>On March 11, pro-Iranian hacktivist group Handala claimed responsibility for a destructive cyberattack on medical device company Stryker. The group says it remotely wiped over 200,000 employee devices across 79 countries and exfiltrated 50TB of data. Stryker filed an SEC report acknowledging significant disruption to its order processing, manufacturing, and shipping systems. More than 5,000 employees in Ireland were sent home during the outage.</p>
<p>Stryker confirmed no ransomware was deployed and said internet-connected medical products were not affected. The breach was contained to its internal Microsoft environment.</p>
<h2>How the attack worked</h2>
<p>Handala didn’t need custom malware. The group gained access to a privileged administrator account — likely through phishing or infostealer malware, though it’s unclear whether MFA was in place — and used that access to take over Stryker’s Microsoft Intune dashboards. Intune is a legitimate endpoint management platform that lets IT administrators remotely wipe, lock, or reconfigure managed devices. Once inside the management plane, Handala issued mass wipe commands across the entire device fleet.</p>
<p>Security researchers note that a compromised Intune or Entra SSO environment gives an attacker the ability to wipe every managed device in an organization without touching a single endpoint directly. No exploit, no payload — just admin credentials and a few clicks.</p>
<h2>Why Stryker</h2>
<p>Handala framed the attack as retaliation for a U.S. missile strike on an Iranian school. The group also cited Stryker’s ties to U.S. defense contracts and its acquisition of an Israeli company as motivations. This appears to be one of the first major U.S. cyberattacks carried out in direct response to the Trump administration’s escalating conflict with Iran.</p>
<h2>Government response</h2>
<p>CISA issued guidance urging organizations to harden their endpoint device management systems. Specific recommendations include:</p>
<ul>
<li>Applying least-privilege principles to administrative roles</li>
<li>Using Intune’s role-based access controls to limit what any single account can do</li>
<li>Requiring dual-administrator approval before high-impact actions like device wipes can be executed</li>
<li>Preventing standard admin accounts from creating new admin accounts</li>
</ul>
<p>The FBI and Justice Department also seized two websites belonging to Handala, with seizure banners citing coordination with a foreign state actor. Handala acknowledged the takedowns on Telegram but said it would continue operations through other channels, including IRGC-linked media.</p>
<h2>What this means for healthcare security</h2>
<p>The Stryker attack is a useful illustration of a risk that doesn’t get enough attention: the management plane. Organizations spend considerable effort securing endpoints and networks, but if an attacker can reach the administrative layer that controls those endpoints, all of that hardening becomes irrelevant. A single compromised admin account with broad Intune permissions is effectively a kill switch for an entire device fleet.</p>
<p>For hospitals and healthcare supply chains that depend on Stryker’s products and logistics systems, the downstream effects of that kind of outage are serious. Stryker says it’s in the process of restoring systems, but order processing and shipping remain disrupted.</p>


Collections

Pro-Iranian hacktivist group Handala claimed responsibility for a destructive cyberattack on medical device company Stryker, remotely wiping over 200,000 employee devices across 79 countries by compromising a privileged Microsoft Intune administrator account. No custom malware was needed — attackers leveraged Intune's legitimate device management capabilities to issue mass wipe commands. Stryker filed an SEC report acknowledging significant disruption to order processing, manufacturing, and shipping. CISA responded with guidance recommending least-privilege principles, role-based access controls, and dual-administrator approval for high-impact actions. The incident highlights the critical risk of management plane compromise: a single privileged admin account can effectively serve as a kill switch for an entire device fleet.

How pro-Iranian hackers used Stryker's own device management tools to wipe 200,000 devices