Iran-Backed Hackers Take MedTech Giant Stryker Offline with Wiper Malware

Stryker, a leading medical technology company, has suffered a significant cyberattack by the Iranian-linked hacktivist group Handala. The attack involved a wiper malware that allegedly wiped over 200,000 systems, servers, and mobile devices, and stole fifty (50) terabytes of data. As a result, Stryker was forced to shut down operations in seventy-nine (79) countries, causing a global network disruption impacting its Microsoft environment. Employees from the United States, Ireland, Costa Rica, and Australia reported that their devices were remotely wiped, and the company’s login pages displayed the Handala logo. Staff were instructed to remove corporate applications from personal devices. The attack has severely disrupted Stryker’s operations, forcing some locations to revert to manual workflows. Handala claims the attack was retaliation for a recent U.S. missile strike on an elementary school in Iran. The group, linked by Unit 42 to Iran’s Ministry of Intelligence and Security (MOIS), is known for data theft, extortion, and deploying destructive malware targeting Israeli organizations. Despite Stryker’s assurance that the incident is contained, the full restoration timeline remains unclear. The attack has raised concerns about supply chain disruptions, as Stryker is a major supplier of medical devices to hospitals worldwide. Some hospitals have temporarily disconnected from Stryker’s services, including LifeNet, to mitigate potential risks. The American Hospital Association is actively monitoring the situation, though no direct impacts on U.S. hospitals have been reported yet. The incident underscores the increasing threat of cyberattacks on critical infrastructure, particularly in the context of geopolitical tensions, and highlights the need for robust cybersecurity measures and preparedness in the healthcare sector.