'Iran's attack on US hospitals': How Stryker hack erased thousands of personal phones overnight

This wasn't just a corporate server outage; it was a digital home invasion. At approximately 3:30 AM EDT on Wednesday, thousands of Stryker employees across the globe woke up to find their personal cell phones completely factory-reset. Hackers had not only breached the company but had successfully triggered a global "kill switch." Employees taking to Reddit confirmed they instantly lost their personal photos, cellular eSIMs, and access to all banking 2FA codes, leaving them digitally stranded in the middle of the night.

How does an Iranian hacker wipe an Australian worker's personal iPhone? The answer is a terrifying wake-up call for anyone who uses their personal phone for work. The hackers (Handala) hijacked Stryker’s Microsoft Intune admin panel, the legitimate cloud software companies use to manage employee access. Because employees had downloaded the Intune "Company Portal" to check their work emails and Teams messages, the hackers were able to push a "remote wipe" command directly to their pockets.

The chaos on the ground was immediate. As 5,500 employees at the European hub in Cork, Ireland, were sent home due to dead servers, the panic reached the US headquarters in Portage, Michigan. Callers ringing the main Stryker corporate media line were abruptly met with a bizarre automated voicemail stating: "We are currently experiencing a building emergency. Please try your call again later." It was a desperate attempt to lock down communications as up to 95% of devices in some offices were being erased in real-time.

While Stryker’s SEC filings played down the event as a contained "network disruption," Handala's official manifesto reads like a geopolitical thriller. The Iran-linked group claimed the attack was direct retaliation for a recent US-backed strike on a girls' school in Minab, Iran. But the hackers took it a step further, bizarrely claiming in their release that Stryker, a $131 billion medical device company, was actually a "central ring in the 'New Epstein' chain." This wild, unverified accusation is a classic psychological warfare tactic used by state-sponsored actors to maximize reputational damage.

The most terrifying aspect of the Stryker hack is the motive. This was not a Russian ransomware cartel looking for a $50 million Bitcoin payout. Handala is backed by Iran's Ministry of Intelligence and Security (MOIS), and they deployed "wiper" malware. Their only goal was irreversible destruction. By claiming to have extracted 50 terabytes of data before permanently wiping over 200,000 systems across 79 countries, Handala sent a clear message to Washington: the US-Israel-Iran war has officially moved into the American corporate sector.

When the opening bell rang, the reality of the attack hit the financial markets hard. Stryker Corporation (NYSE: SYK) shares plummeted over 5% as investors realized they were looking at a "wiper" attack, not a traditional ransomware hostage situation. In a ransomware attack, a company can secretly pay millions in Bitcoin to get a decryption key and be back online in days. But Handala's malware permanently overwrote the core system files. Wall Street is currently pricing in the terrifying reality that Stryker may have to physically rebuild its entire global IT infrastructure from scratch, a process that could take weeks and cost hundreds of millions of dollars.

As rumors swirled that hacked medical devices could be remotely shut down, Stryker scrambled to prevent a global hospital panic. The company issued a critical emergency update specifically confirming that their flagship medical tech, including Mako robotic surgery systems, Vocera hospital communications, and LIFEPAK defibrillators, are "fully safe to use" and completely insulated from the corporate IT wipe. However, the American Hospital Association is now warning of massive downstream supply chain failures. Even if the robots are safe today, a paralysed Stryker means hospitals worldwide cannot order new surgical tools, receive critical cybersecurity patches, or get maintenance on life-saving equipment.