Most of the incidents we write about end with data somewhere it should not be. This one did not. Nothing was taken from Stryker. Things were simply deleted, at scale, using the company's own tools.
What happened
On 11 March 2026, Stryker — a Michigan-headquartered medical device manufacturer with a global workforce — was hit by a destructive attack. Attackers reached an administrator account inside the company's Microsoft environment and used it to issue mass wipe commands. Tens of thousands of employee laptops and mobile devices were erased within hours.
Stryker confirmed the attack publicly and said it was in the process of restoring its computers and internal network. It stated the incident was contained to its internal Microsoft environment and that its internet-connected medical products were safe to use. Investigators found no evidence of ransomware or other malware on the systems — because none was needed. Days later the company said its ability to process orders, manufacture and ship devices was still disrupted. The incident reached the quarterly results.
A pro-Iran group calling itself Handala claimed responsibility, framing it as retaliation for events unconnected to Stryker's business.
The likely instrument was Microsoft Intune, the mobile device management platform. Security researchers point to phishing or infostealer malware as the probable route to the administrator account. That detail is the one worth sitting with.
The tool that did this was working correctly
Intune's purpose is to let a small team apply a change to every device in an organisation at once. Push a policy, deploy an application, and — when a laptop is lost or an employee leaves — remotely wipe it. That last capability is not a flaw. It is the product, and most organisations are right to have it switched on.
But it means the console is a loaded instrument pointed at your entire fleet, and an administrator account on it is worth more to an attacker than almost any other credential in the business. There is no exploit to patch here, no CVE to track. The attacker logged in and used the documented feature.
This generalises further than Intune. Every organisation of any size now runs at least one tool whose entire job is to make a change everywhere simultaneously: an MDM, an RMM, a configuration management platform, a CI/CD pipeline with deployment keys. Each one is a single account away from being the most destructive thing in the environment.
Why a wiper is a different problem from ransomware
Ransomware has conditioned how most organisations think about recovery, and it has done so misleadingly. A ransomware operator wants to be paid, which means they want you to recover — eventually, on their terms. There is a negotiation, a decryptor, and a bad but survivable path that does not depend solely on your own backups.
A wiper offers none of that. There is no contact, no key, no leverage to apply. The data is gone, and the only route back is the one you built yourself before it happened. Every untested assumption in your recovery plan becomes load-bearing on the same morning.
That is the uncomfortable test this incident poses. Most organisations we assess have backups of their servers and their file shares. Far fewer have a credible answer for what happens when the endpoints themselves — the laptops people actually work on, with whatever was sitting in a local folder — are wiped simultaneously. Fewer still have ever timed the rebuild.
"Why would anyone target us?"
Handala's stated reason for choosing Stryker had nothing to do with Stryker's security posture, its sector, or its size. It was geopolitical, and it was about associations the company had made in the course of ordinary business.
This is the part that makes target-selection reasoning unreliable. An organisation can be chosen for who its customers are, which government contracts it holds, who acquired it, where its parent is headquartered, or simply because it was reachable during a week when someone wanted a target. "We are not interesting enough to attack" assumes attackers share your view of what makes a business interesting. Increasingly they do not.
What to actually do
Treat the management consoles as your crown jewels. Inventory every tool that can make a change across your whole estate — MDM, RMM, endpoint management, directory, CI/CD. For each, write down who holds administrative access and when that list was last reviewed. Most organisations find the list is longer and staler than they expected.
Phishing-resistant MFA on those accounts, without exception. Hardware keys or passkeys, not push notifications and not SMS codes. If the route in was a phished or stolen credential, this is the control that would have mattered most.
Separate administration from daily work. An administrator should not read email on the account that can wipe the fleet. Separate identities, and privileged access requested and granted for a window rather than held permanently.
Put a speed limit on mass actions. Ask your platform what it does when someone selects every device and chooses wipe. Where the tooling supports approval workflows, rate limits, or alerting on bulk operations, turn them on. A destructive command that takes two people and ten minutes is a very different risk from one that takes one click.
Alert on the console itself. Administrative sign-ins from new locations, new admin role assignments, and bulk device actions should generate a notification that a human reads. This incident played out over hours, not seconds.
Know your endpoint recovery time, measured. Not "we have Intune, we can re-enrol" — an actual figure from an actual rebuild. How long to get one laptop back to working? How many can your team do per day? What does a user lose that was only on their device? If you cannot answer those, a wiper is a much worse day for you than for an organisation that can.
The summary
Stryker was not breached through a clever exploit. Someone got an administrator account and used a documented feature exactly as designed. The defensive lesson is not about a vendor or a patch; it is that the tools you bought to manage thousands of devices efficiently are equally efficient in the wrong hands, and that recovery — the discipline everyone funds last — is the only control that still works after everything else has failed.
Sources
- Stryker says it's restoring systems after pro-Iran hackers wiped thousands of employee devices — TechCrunch
- Iran-Backed Hackers Claim Wiper Attack on Medtech Firm Stryker — Krebs on Security
- Stryker cyberattack has impacted first quarter earnings — HIPAA Journal
- Exposure brief: Iranian-linked wiper attack on global medtech firm Stryker — Censys
