Iran-linked hacktivist group Handala remotely wiped between 80,000 and 200,000 devices belonging to US medical-device maker Stryker across 79 countries on 11 March 2026 using a single stolen Microsoft Intune administrator credential1. No malware was deployed. No payload ran on the endpoints. The attackers used the Mobile Device Management (MDM) console, Microsoft's cloud platform for remotely configuring and wiping enrolled laptops, phones and tablets, the way its legitimate operators do, from the Stryker tenant's own admin pane.
Stryker is the Kalamazoo-headquartered Fortune 500 manufacturer whose orthopaedic implants, surgical tables and hospital beds sit in almost every operating theatre in the United Kingdom and United States. NHS Supply Chain, the National Health Service procurement body for England, issued a disruption alert to UK hospitals on 18 March warning that Stryker ordering, manufacturing and invoicing systems were degraded, with most product lines projected to return by 10 April2. For three weeks, trusts running Stryker-supplied kit reverted inventory workflows to paper and delayed scheduled procedures. Handala claimed 50 terabytes exfiltrated and framed the operation as retaliation for a February missile strike on an Iranian school.
An Intune admin account has authority equivalent to root on every device in the tenant. Most Endpoint Detection and Response (EDR) products cannot block a wipe command issued from the legitimate MDM console because, to the EDR, it looks like authorised IT activity. The defensive perimeter the industry has spent five years building, around endpoints, around networks, even around cloud workloads, has no view into the console that controls all of them. Conditional Access, Microsoft's policy engine for step-up authentication on admin roles, is the control that should have caught this. The question the Stryker incident forces on every Chief Information Security Officer (CISO) is whether their own MDM tenant has it configured tightly enough to stop a single stolen credential from reaching the wipe button.
The industry has been told this for half a decade. The 2020 SolarWinds SUNBURST compromise and the 2022 Okta Lapsus$ breach established identity as the attack surface. Zero Trust became doctrine. Conditional Access was sold as the answer. Stryker is the first mass-scale, no-malware, MDM-level demonstration that the doctrine did not translate into operational posture. CrowdStrike's $740m acquisition of session-revocation vendor SGNL in January, and the 80 cybersecurity acquisitions announced across February and March, track the same thesis commercially. The commercial signal is now running ahead of the defensive one.
