The Stryker Wiper Attack

It’s pretty common for the culprits behind cyberattacks to be state-sponsored hackers working for US adversaries like China or Russia, so the United States entering into war with Iran last month has some disturbing implications for the cyber world. All of the sudden, threat actors who would see US networks and companies disrupted have increased significantly, and we in the cybersecurity community have to be that much more vigilant about securing our networks if we want to protect ourselves. The medical and surgical equipment maker Stryker had the misfortune of learning this the hard way.

The Incident

On March 11th, what appeared to be a pro-Iran hacktivist group called Handala compromised one of Stryker’s administrator accounts for Microsoft’s Intune, a cloud-based endpoint management service. After initial access, they proceeded to create a new Global Administrator account and use it to issue a “wipe” command to nearly 80,000 servers, erasing immense amounts of data from Stryker offices across the world all without using malware or other malicious software. Additionally, Handala stole and leaked 50 terabytes of data from the company’s servers.

According to the hackers, they performed this attack in retaliation for continued cyberattacks on Iranian infrastructure and a US missile strike that hit a Minab school, killing 168 children and seven others. Stryker has no apparent connection to these attacks, though they have some operations in Israel and last year secured a $450 million contract with the Department of Defense to supply medical devices to the military.

Immediately, Stryker entered into a state of emergency as their order processing, manufacturing, and shipping capabilities were disrupted by the wiper attack, causing thousands of employees across the world to be sent home for the day. Thankfully, the attack was limited to Stryker’s internal Microsoft environment, meaning the security and safety of the company’s products or devices weren’t compromised, but there were reports of some surgical procedures being delayed due to Stryker being unable to deliver patient-specific products.

It took until the first week of April for Stryker to become fully operational again, and the company has reported that the incident will have a material impact on their first-quarter earnings. To top it all off, Stryker is now facing lawsuits from at least 6 employees who claim Stryker failed to protect their personal data.

Not What They Seem

Just a week after Handala launched their cyberattack on Stryker, the FBI made an interesting discovery about Handala after they seized four domains linked to Iranian cyberattacks, including two domains used by the cybergang to leak the data stolen from Stryker’s servers. Hours after the operation, the DOJ accused Iran’s Ministry of Intelligence and Security (MOIS) of using all four of these domains to launch attacks through activist personas, citing and FBI investigation that revealed “the four seized domains were linked to each other through shared leak sites, Iranian IP ranges, and a common operational ‘playbook.’”

This means the wiper attack on Stryker was conducted by state-sponsored hackers rather than third-party hacktivists, so Iran certainly recognizes the value of disrupting American infrastructure and companies through cyber warfare.

Conclusion

Evidently, the war with Iran will also be fought on the cyber landscape. Iran will continue to find lapses in American cybersecurity wherever they can, and next time it might be your company that experiences a massive loss of data. Obviously, that would be very bad, so if you haven’t prioritized cybersecurity in the past, start today. If you don’t know where to start, we at Crimson Vista offer auditing services to determine the current state of your security posture and what you can do to improve. Finally, remember to keep an eye on what’s happening in the real world, because it can still impact what happens in our digital one.

Sources

• https://docs.google.com/document/d/1NGtcovBfw14P_Kwm2JtVZMB6lwuyy8nPdqUy4WtvM6M/edit?tab=t.0
• https://techcrunch.com/2026/03/11/stryker-hack-pro-iran-hacktivist-group-handala-says-it-is-behind-attack/
• https://www.bleepingcomputer.com/news/security/stryker-attack-wiped-tens-of-thousands-of-devices-no-malware-needed/
• https://techcrunch.com/2026/03/17/stryker-says-its-restoring-systems-after-pro-iran-hackers-wiped-thousands-of-employee-devices/
• https://www.justice.gov/opa/pr/justice-department-disrupts-iranian-cyber-enabled-psychological-operations
• https://www.hipaajournal.com/stryker-cyberattack-iran/
• https://www.stryker.com/us/en/about/news/2026/a-message-to-our-customers-03-2026.html