The March 11 cyberattack hit Stryker’s internal systems, impacting its ability to process orders, manufacture products, and ship them globally.
As a result, some patient-specific procedures had to be rescheduled due to delays in delivering customized medical inventory.
The company confirmed that the disruption was limited to its Microsoft environment and emphasized that “no patient-related services or connected medical products were affected.”
However, internal operations slowed significantly, with employees reporting communication breakdowns after work-issued devices stopped functioning.
The attack is being linked to Handala, a hacking group believed to have ties to Iran’s intelligence operations. The group claimed the incident was retaliatory, marking what appears to be one of the most significant cyberattacks by Iran-linked actors on a U.S. company in recent years.
Historically, such groups have carried out destructive attacks designed to erase data, and this incident signals a shift from low-impact disruptions to more operationally damaging actions.
TL;DR
- Cyberattack disrupted Stryker’s Microsoft environment, delaying some surgeries
- Iranian-linked group Handala claimed responsibility for the attack
- Hackers remotely wiped up to tens of thousands of employee devices
- No ransomware or malware detected, products and patient systems remain safe
- U.S. authorities urge companies to secure Microsoft Intune systems
Join The Discussion