Medical technology giant Stryker confirmed on Monday that the cyberattack on March 11, which crippled its global operations, has been fully contained. The company continues to work around the clock to restore severely disrupted ordering and shipping systems after Iran-linked hackers weaponized the company’s device management tools to wipe data from tens of thousands of employee devices across dozens of countries worldwide.
The attack, claimed by the pro-Iran hacking group known as Handala, ranks as one of the most destructive cyber operations ever carried out against a major American corporation. It also marks a prominent turning point as the first time the group has targeted a massive U.S. organization rather than its usual Israeli victims.
How the devastating attack happened
In a latest customer briefing dated March 23, Stryker revealed that despite its initial belief that no malware was present, investigators from Palo Alto Networks’ Unit 42 later discovered a malicious file used by the attackers to run commands and conceal their activity within company systems. The company emphasized that the file was not capable of self-propagation and that no malicious activity was directed toward customers, vendors, or partners.
According to reports specializing in information security, the attackers managed to breach an administrator account on the Microsoft Intune platform to create a new global admin account. Through this compromised account, the hackers issued remote wipe commands that erased data on approximately 80,000 devices between 5:00 and 8:00 AM UTC on March 11. Meanwhile, the Handala group claimed it successfully wiped over 200,000 devices across 79 countries, although investigators questioned many of the group’s claims, including its assertion that it stole 50 terabytes of sensitive data.
Employees in Ireland, the United States, Australia, and India found their laptops, phones, and servers completely wiped, with the Handala logo displayed on login screens. Stryker was forced to send more than 5,000 workers home from its operations in Ireland alone and closed its offices worldwide. The attack disrupted order processing, manufacturing, and shipping, though the company stressed that its medical devices, including surgical robots and defibrillators, remained entirely safe to use.
Geopolitical background and U.S. reactions
The Handala group framed the attack as retaliation for a U.S. missile strike targeting a school in the Iranian city of Minab, which resulted in the deaths of more than 175 people at the start of the U.S.-Iran conflict in late February 2026. The group, which cybersecurity researchers link to the Iranian Ministry of Intelligence and Security, had previously focused on Israeli targets before escalating its operations to target a major U.S. company of this scale.
The U.S. Department of Justice moved swiftly, seizing four internet domains used by Handala to claim responsibility for the breaches, publish stolen data, and issue death threats against journalists and dissidents. The DOJ described these sites as tools for hacking operations and transnational repression schemes run by the Iranian Ministry of Intelligence. The group acknowledged the seizure via Telegram, calling it a “desperate attempt to silence our voice,” and later resumed operations via a new domain.
A new generation of cyberattacks
Living off the land and expert warnings
“This is a critical warning, it is a wake-up call for every organization.” – Former Director of the U.S. Cybersecurity and Infrastructure Security Agency.
Cybersecurity analysts emphasize that this incident represents a major shift in destructive cyber operations. Rather than deploying ransomware or custom malware, the attackers used an advanced technique, turning Stryker’s cloud-based device management infrastructure into a lethal weapon against the company itself.
Stryker is considered one of the leading global companies in medical technology, and its products play a vital role in saving lives and facilitating complex surgeries in hospitals and clinics around the world. Therefore, any disruption in the supply chain or delay in medical device delivery can have serious repercussions for the entire healthcare sector.
Furthermore, the use of modern intrusion techniques raises growing concerns among cybersecurity experts. This method relies on using legitimate tools already present within the victim’s IT environment, making attack detection extremely difficult. The device management platform functioned exactly as designed; the failure lay in how high-privileged access to the platform was secured. Company SEC filings warned that the full operational and financial impacts remain unknown, even as its core transaction systems are on a clear path to full recovery.
Frequently Asked Questions
What was the cyberattack that Stryker faced?
Stryker suffered a devastating cyberattack on March 11 that crippled its global operations, as hackers breached device management systems and wiped data from tens of thousands of employee devices.
Who is responsible for the attack?
The Iran-linked hacker group Handala claimed responsibility for the attack, which marked its first direct targeting of a major U.S. corporation in retaliation for a U.S. military strike in Iran.
Were the company’s medical devices affected by this attack?
No, the company confirmed that its medical devices, including surgical robots and defibrillators, were unaffected and remained completely safe for medical use.
How did the hackers carry out their attack without using traditional ransomware?
The attackers used an advanced method based on abusing the company’s legitimate cloud infrastructure and management tools, taking control of administrative accounts to issue remote device wipe commands.
