‘Stryker cyber attack’: Why Iran-linked hackers Handala chose US giant Stryker as their target
US medical giant Stryker suffered a massive cyber attack by Iran-linked group Handala, wiping thousands of global devices. The hackers claim the breach is retaliation for a recent bombing in Iran and the firm's business ties to Israel.
56,000 Employees Go Offline
US medical technology giant Stryker suffered a massive cyber attack on March 11, 2026. The breach forced the company to shut down its global IT infrastructure, leaving nearly 56,000 employees locked out of their computers. Internal networks and communication systems across multiple continents went dark simultaneously.
Iran-Linked Handala Strikes
A hacktivist group known as Handala claimed responsibility for the cyber attack. Cybersecurity experts widely link this group to Iranian intelligence operations. The attackers left their logo and threatening messages on the login screens of compromised corporate devices before wiping them completely.
200,000 Devices Wiped Clean
The attackers deployed a highly destructive wiper malware designed to permanently erase system data rather than demand a ransom. This malicious software successfully wiped over 200,000 servers, laptops, and mobile phones connected to the corporate network. Even personal smartphones with company profiles installed were completely erased.
50 Terabytes Data Stolen
Before initiating the destructive wiping process, the hackers claim to have extracted a massive amount of corporate information. They announced the theft of 50 terabytes of critical data, which could include sensitive procurement contracts and technical documents. Security teams are still investigating the full scope of the missing information.
Retaliation For Minab Strike
Handala publicly stated that this cyber operation was a direct retaliation for a recent missile strike on a school in Minab, Iran. The bombing reportedly resulted in the deaths of over 100 people, mostly children. The hackers described the attack as the beginning of a new chapter in global cyber warfare.
Stryker's 2019 Israel Deal
The hacker group specifically targeted the medical giant due to its perceived business ties to Israel. Handala highlighted Stryker's 2019 acquisition of OrthoSpace, an Israeli medical technology company, as the primary justification for the attack. The group explicitly warned that any corporation with similar ties remains a potential target.
Microsoft Intune Platform Abused
Investigators believe the hackers bypassed the need for custom malware by exploiting a legitimate enterprise IT tool. Evidence suggests they gained administrative access to the Microsoft Intune cloud management platform used by the company. This access allowed them to issue a simultaneous remote wipe command to every enrolled endpoint.
5,500 Ireland Staff Hit
The cyber attack severely disrupted operations at the company's largest hub outside the United States, located in Cork, Ireland. Approximately 5,500 workers at the manufacturing plant were sent home as engineering and product design systems failed. Manufacturing machines were forced offline, bringing the facility to a complete standstill.
79 Countries Shut Down
The disruption quickly cascaded across the global healthcare supply chain, forcing office closures in 79 different countries. Hospitals relying on these critical medical devices, orthopedic implants, and surgical instruments face potential delays. The company has implemented emergency business continuity measures to maintain operations while experts attempt to restore the systems.
Shares Drop 4 Per Cent
The unprecedented cyber attack triggered immediate financial repercussions for the Fortune 500 company, which reported $25 billion in revenue last year. Company shares fell by roughly 4 per cent within hours of the global IT outage becoming public knowledge. A timeline for full digital recovery remains unknown due to the permanent data loss.
)
)
)
)
)