Stryker Corporation
US medtech firm; Handala wiper destroyed 200,000 devices via single Intune credential, March 2026.
Handala, a hacking group tied to Iran's intelligence ministry, wiped up to 200,000 Stryker devices in 79 countries on 11 March 2026 with one stolen Microsoft Intune login, and called it revenge for the strike on the Minab school.
Last refreshed: 12 October 2026 · Appears in 3 active topics
Is an SEC-reportable attack possible with no malware, just one stolen cloud login?
Timeline for Stryker Corporation
Declared its March device wipe material
Cybersecurity: Threats and Defences: Mentioned in: Boston Scientific likely to miss guidanceMentioned in: West Pharma SEC 8-K on ransomware halt
Cybersecurity: Threats and DefencesIvanti EPMM logs fourth KEV zero-day since 2023
Cybersecurity: Threats and DefencesFiled SEC 8-K/A disclosing the March MDM wipe as a material cybersecurity incident with Q1 earnings impact
Cybersecurity: Threats and Defences: Stryker SEC filing marks cyber milestoneMentioned in: Israel kills Larijani, last negotiator
Iran Conflict 2026Background
Stryker Corporation makes surgical equipment, orthopaedic implants and operating-room systems for hospitals worldwide, and is based in Kalamazoo, Michigan. Since March 2026 the company has also been the reference case for an enterprise crippled through its own device-management console rather than by malicious code.
On 11 March 2026 the attackers used a single stolen Microsoft Intune administrator credential to send wipe commands to between 80,000 and 200,000 enrolled laptops, phones and tablets. No malware ran on any of Stryker's endpoints. Krebs on Security called the intrusion credential-only: the intruders drove the console exactly as Stryker's own IT team would have. British trusts using Stryker equipment delayed procedures and tracked stock on paper for three weeks.
Stryker filed a Form 8-K/A with the US Securities and Exchange Commission on 10 April 2026, declaring the wipe a material incident. The amendment admitted a hit to first-quarter 2026 earnings while keeping full-year guidance. No earlier wipe issued through a Mobile Device Management console had triggered SEC disclosure, and no earlier material filing had covered an attack without malware or a ransom demand. Disclosure counsel at listed US companies now cite the Stryker filing when judging identity-only intrusions.
Stryker became a wartime retaliation target
Handala claimed the Stryker attack on 11 March 2026 and left its own logo on the login screens of wiped machines. The group named the strike on the girls' school at Minab, where 165 pupils died, as its motive, which pulled a Michigan maker of surgical kit into the Iran war. Palo Alto Networks' Unit 42 links Handala to Iran's Ministry of Intelligence, and the group also claimed to have taken 50 terabytes of data.
Stryker told the SEC of a global disruption to its Microsoft environment. British hospitals felt it within a week: on 18 March NHS Supply Chain warned trusts that Stryker ordering, manufacturing and invoicing were degraded, and that most product lines would not be back to normal before 10 April.
What happened to Stryker in the cyber attack?
Did the Stryker hack affect NHS hospitals?
How did Stryker disclose the cyber attack to the SEC?
How do companies protect against MDM wipe attacks like Stryker's?
What security controls would have stopped the Stryker attack?
