Stryker Cyberattack: Tens of Thousands of Employee Devices Wiped in Massive Data Breach

Stryker Cyberattack: Tens of Thousands of Employee Devices Wiped in Massive Data Breach

A Cyberattack on Medical Device Manufacturer Stryker Wipes Tens of Thousands of Employee Devices, Disrupts Global Operations

A recent cyberattack on Stryker, a prominent medical device manufacturer, has resulted in the destruction of data on nearly 80,000 employee devices worldwide.

Attack Details

The attack, which occurred on March 11, targeted the company’s internal Microsoft environment, affecting its global operations and forcing manual order processing.

According to reports, the attackers compromised an administrator account and created a new Global Administrator account, granting them the authority to issue remote wipe commands across Stryker’s managed device fleet.

As a result, employees in multiple countries reported that their company laptops and phones had been erased overnight, with some also losing data on personal devices that had been enrolled in the company network.

Attack Method and Impact

The attack did not involve ransomware or malware, but instead utilized Microsoft Intune’s remote wipe capability to destroy data on the affected devices.

This approach has been described as a form of “digital paralysis,” as it rendered the devices inoperable and resulted in a significant disruption to the company’s operations.

Stryker has stated that the attack was contained to its internal corporate environment and did not affect its connected products, digital tools, or other life-saving technologies.

Investigation and Response

The attack has been claimed by a group known as Handala, which is believed to have links to Iran.

However, the group’s claims of wiping more than 200,000 systems and stealing 50 terabytes of data have not been verified, and Stryker has not endorsed these figures.

The incident is being investigated by Microsoft’s Detection and Response Team (DART) and Palo Alto Networks’ Unit 42, with Stryker also working with authorities and outside cybersecurity experts to assess the operational and financial implications of the breach.

The attack serves as a reminder that cyber risk is no longer confined to stolen records or frozen desktops, and that companies must prioritize the security of their internal control planes to prevent such disruptions.

Aftermath and Response

In the aftermath of the attack, Stryker has emphasized the importance of separating fact from fiction in the public narrative surrounding the incident.

The company has not confirmed the details of Handala’s claims, and investigators have found no evidence of data exfiltration.

As the investigation continues, Stryker is working to restore its systems and minimize the impact of the attack on its operations and customers.



About Author

en_USEnglish