Stryker (medical technology manufacturer): Iran-linked Handala wipes devices via Microsoft Intune

What happened

• Stryker confirmed a cyberattack that disrupted its internal Microsoft environment worldwide. In a 15 Mar update it said the event “was contained to Stryker’s internal Microsoft environment”, was not ransomware, deployed no malware, and did not affect its medical products. Electronic ordering went offline and customers had to order manually through sales reps.
• Root cause: reporting (BleepingComputer source, Security Affairs) says the attacker compromised an administrator account, created a new Global Administrator, and used the Intune remote-wipe command on nearly 80,000 devices between 05:00 and 08:00 UTC. Stryker and Microsoft had not confirmed the initial access vector.
• Attacker: Handala claimed it; SecurityWeek and Palo Alto assess Handala as a front for Iran’s MOIS (Void Manticore). Handala’s claims of 200,000 wiped systems and 50 TB stolen are unverified.
• Response: Microsoft DART leads the investigation with Unit 42; Stryker filed an SEC 8-K.

Sources

• https://securityaffairs.com/189535/hacking/attack-on-stryker-s-microsoft-environment-wiped-employee-devices-without-malware.html
• https://industrialcyber.co/medical/suspected-iran-linked-cyberattack-hits-medical-technology-giant-stryker-amid-middle-east-tensions/
• https://krebsonsecurity.com/2026/03/iran-backed-hackers-claim-wiper-attack-on-medtech-firm-stryker/
• https://www.cybersecuritydive.com/news/stryker-attack-device-management-microsoft-iran/814816/
• https://www.cybersecuritydive.com/news/stryker-confirms-cyberattack-is-contained-and-restoration-underway/815427/

This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.