Iranian-linked hackers suspected in cyberattack on Stryker’s Cork headquarters

A global medical technology company with a major presence in Ireland has been severely disrupted by a suspected cyber attack linked to an Iranian-backed hacking group. Stryker Corporation, which employs thousands of staff in Ireland and operates its European headquarters in Cork, experienced the attack on Wednesday (March 11). According to the Irish Examiner, the incident is believed to be a ‘wiper’ cyberattack, a destructive type of intrusion designed to erase data from targeted systems permanently.

What is a wiper attack?

Ireland’s National Cyber Security Centre has been notified and is reportedly responding to the incident. A wiper attack is considered one of the most severe forms of cyber intrusion because the goal is not financial extortion but the destruction of systems, often linked to geopolitical or state-backed operations. Sources familiar with the situation said systems at Stryker’s Cork headquarters were forced offline, while company-issued devices used by employees were wiped. Login screens on affected devices were reportedly defaced with the logo of the hacking group known as Handala Hack.

The group is believed to be aligned with the Iranian regime, which is currently engaged in military and economic confrontation following recent hostilities involving the United States and Israel. The attack has disrupted operations at Stryker by disabling technology used in the production of its medical devices. Efforts are now underway to restore affected systems and ensure manufacturing can continue. Some machines used in the production of medical devices in Cork are reportedly still operating, though it remains unclear how long they will remain functional if systems cannot be fully restored.

Also Read: White House area under lockdown after car crashes into security barricade

A spokesperson for Stryker confirmed that the company is working urgently to recover from the disruption. “We are currently experiencing a global network disruption affecting the Windows environment. Our teams are actively working to restore systems and operations as quickly as possible. Stryker has business continuity measures in place, and we’re committed to continuing to serve our customers.” Reports from Israeli media suggest that the Handala group has also claimed responsibility for breaching the website of the Academy of the Hebrew Language.

International technology media outlets have reported that the group may have compromised several oil and gas facilities across Israel, Jordan, and Saudi Arabia. Meanwhile, the Israeli National Cyber Directorate said it has been attempting to intercept a recent surge in Iranian cyber attacks targeting Israeli civilian companies. Sources indicated that Stryker may have been targeted due to its business ties with Israel. One employee described the scale of the disruption as significant. "Anything connected to the network is down," they said. "All support staff, administrative staff, and engineers have been sent home. "And anyone with Outlook on their personal phones had their phones wiped."

Staff members are now relying on WhatsApp groups to communicate while waiting for updates on when they can safely return to work. Employees were also warned not to reconnect to the company network using any device or applications such as Microsoft Outlook or Teams until clearance is given.

A message sent to staff read, “We know that the situation creates uncertainty. Please know that our teams are actively addressing the issue with security experts and law enforcement.” “Our people and our sites are safe. We are focused on our customers and the patients they serve, while ensuring the continuity of their operations and our own.” “Please stay focused and follow guidance from your leaders while we work to restore systems.”

Ireland hosts Stryker’s largest operations outside the United States. The company runs six manufacturing facilities and three innovation centres across Cork, Belfast, and Limerick, employing more than 5,500 workers in the country. The hacking group uses the image of Handala, a cartoon of a young Palestinian boy created in 1969 by Palestinian political cartoonist Naji al-Ali, a symbol that has long been associated with Palestinian resistance.

Disclaimer: WION takes utmost care to accurately and responsibly report ongoing conflicts in West Asia involving Israel, Iran, the US, Gulf nations, and non-state actors like Hezbollah, Hamas, Houthis, Islamic State, and others. Claims and counterclaims, disinformation and misinformation are being made online and offline. Given this context, WION cannot independently verify the authenticity of all statements, social media posts, photos, and videos.