In today’s bulletin, Charlie discusses Stryker Corporation’s recent cyber attack and provides a timeline of events and the lessons we can learn from the attack.

Over the last couple of weeks, I have been doing some research into the Stryker attack. It was interesting to me for a number of reasons. I like writing case studies, as it is good to understand different incidents and to learn the lessons from the attack and then be able to pass them on to others through training and exercises. The incident is also interesting because the attack was a fallout of the Iranian war and because a state used cyber as part of hybrid warfare. There are a number of interesting differences in this cyber attack from the ‘normal’ ransomware attacks.

Who Are Stryker?

The Stryker Corporation is a leading global medical technology company that designs, manufactures, and supports solutions used across healthcare systems worldwide. Its products include surgical instruments, orthopaedic implants, neurotechnology and spinal devices, endoscopy and imaging systems, and patient-handling and emergency care equipment. It also provides a wide range of healthcare services, which include digital health solutions, clinical education and training, equipment maintenance, and ongoing technical and operational support for healthcare providers. This includes internal clinical communication systems used by hospital staff to coordinate care, respond to alerts, and manage workflows, so its services are integral to the delivery of care and support to patients in hospitals. Founded in 1941 and headquartered in Kalamazoo, Michigan, in the U.S., Stryker operates in over 75 countries and employs approximately 50,000 staff globally, playing a critical role in supporting patient care and clinical operations across the healthcare sector.

Attack Timeline

Impact On The Company And Their Customers

The cyber attack had a significant impact on Stryker Corporation’s ability to deliver services to its customers and on its internal workforce. The disruption to its internal Microsoft environment halted production, disrupted ordering systems, and caused shipping delays, leading to shortages of medical products and the postponement of some surgical procedures. In certain cases, hospitals were forced to suspend connections to Stryker systems and rely on manual workarounds such as radio communication, highlighting the knock-on effect on clinical operations.

Internally, the impact on employees was immediate and widespread, with large numbers of devices wiped and rendered unusable, including laptops and some personal devices enrolled in the network, resulting in loss of data and productivity. Reports also indicated that over 5,000 staff were sent home from a major manufacturing site in Ireland, further disrupting operations. Overall, the attack caused both operational paralysis within the company and tangible downstream effects on healthcare delivery.

The cyber attack on Stryker Corporation directly impacted the NHS due to its reliance on Stryker products across multiple clinical areas. Disruption to production and distribution created supply constraints, with some product lines subject to controlled demand management and limited availability by NHS Supply Chain. NHS England indicated that existing stock may only cover a short period, after which further disruption was likely, requiring trusts to implement mitigation measures, such as mutual aid and prioritising critical procedures. The incident also introduced a risk to patient care, particularly in areas such as trauma, orthopaedics, and surgical services, where Stryker devices are widely used, highlighting the NHS’s dependency on key suppliers within its supply chain.

Who Were The Attackers?

The cyber attack on Stryker Corporation was attributed to the hacktivist group Handala, also known as the Handala Hack Team, which is widely assessed by the threat intelligence community to be a front for Iran’s Ministry of Intelligence and Security (MOIS). The group operates as a ‘faketivist’ persona, combining politically motivated messaging with destructive cyber capabilities, and has been linked to a broader cluster of Iranian state-aligned actors (including aliases such as Void Manticore, Cobalt Mystique, and Red Sandstorm).

In this incident, Handala claimed responsibility via its website and associated domains, stating the attack was retaliation for geopolitical events involving the United States and Israel. There were also reports that the group’s branding appeared directly within Stryker’s environment, with employees and social media posts indicating that the Handala name and logo were displayed on company login pages following the attack, reinforcing the psychological and attribution messaging of the operation.

As part of the wider response, U.S. authorities took action against the group’s online infrastructure: the Department of Justice seized four domains used by Iranian cyber actors, including those associated with Handala’s propaganda and claim activity, which had been used to publicise attacks and conduct psychological operations. This takedown formed part of a broader effort to disrupt Iranian cyber-enabled influence and disruption campaigns linked to the incident.

How The Attack Was Carried Out

The attack on Stryker Corporation was a large-scale, destructive cyber operation focused on the company’s internal Microsoft environment, most likely exploiting administrative control of its endpoint management system. The attackers are reported to have gained access to a Microsoft Intune administrator account, either through compromised credentials or privilege escalation, allowing them to use legitimate system functionality to issue remote wipe commands across the organisation.

This resulted in the deletion of data on tens to hundreds of thousands of devices, including laptops, servers, and mobile devices, with some personal devices enrolled in the network also affected. Rather than deploying traditional ransomware, the attackers used this native capability to cause immediate operational disruption, halting production and impacting ordering and shipping systems.

While early communications suggested no malware, subsequent investigation identified the use of a malicious file to execute commands and conceal activity within the environment, although it was not capable of spreading. The attack therefore combined misuse of trusted administrative tools with targeted destructive actions, achieving significant impact without relying on conventional malware propagation techniques.

What Can We Learn From This Attack?

1. Privileged accounts were used to execute the attack, which is a similar method used in the Marks & Spencer and JLR attacks. Once you have access to these accounts, attackers can basically execute most attacks they want to carry out.
2. The use of company tools, including Microsoft Intune, to execute the attack shows that you can use company tools to carry it out and that malware is not always required.
3. As the attack deleted all company personal accounts for most staff, they could do nothing until their accounts were restored.
4. Where an organisation provides a critical service, such as Stryker did in hospitals, you have to have a manual workaround to continue patient care, as this cannot be ‘parked’ until systems are restored. Many manual workarounds require additional staff, as manual tasks take longer. In health settings, if you lose access to IT, you may have difficulty accessing patient records, including their health history, diagnoses, test results, and current care requirements. This needs to be thought through when planning for a cyber incident.
5. The current geopolitical instability caused by Iran and the potential closing of the Strait of Hormuz will have a wide range of impacts across supply chains, especially affecting just-in-time delivery. I would expect that organisations are likely increasing their stock levels, if they have not already, to prepare for supply chain disruption. If organisations are not already stockpiling essential supplies, these attacks should be a wake-up call to consider potential shocks to their supply chains and to take measures to reduce their vulnerability to supplier or route disruptions.
6. In a wiper attack, there is no opportunity to pay a ransom to get your data back, so the importance of backups is again highlighted. The organisation was able to resume most operations within two weeks, which, to me, shows that they had good backups and that the two weeks were spent restoring systems. With over 50,000 employees, if they were rebuilding from scratch, this would have taken much longer and the impact on the organisation and its customers would have been far greater.
7. Where your products and services are key to patient safety, you have to communicate early and often to provide reassurance. You can see in the attack timeline that on some days there were multiple communications on the company website about different products. Reassurance that Stryker’s products were safe and unaffected by the attack was a key message. This shows good practice and an understanding of the concern the attack would cause for customers.
8. Their first communication was within hours of the attack, which shows good practice.
9. Until you can reassure customers and suppliers that there is no longer an attacker in your systems and that you have contained and eradicated the threat, organisations will disconnect their systems from yours and may block incoming communications. This greatly impacts your ability to communicate and coordinate with customers. On the 23rd March, the company issued a letter from Palo Alto Networks Unit 42 confirming that the threat had been eradicated. This is the first time I have seen this in corporate communications, and it shows that rebuilding trust and restoring communication and workflow were key to recovery. By publicising the methods used in the attacks, they demonstrated that they understood how the attacks were conducted and reassured technical stakeholders that this was not a ransomware attack and that the method used to wipe data was unlikely to have further unknown impacts.
10. The takedown of the attackers’ websites by the Department of Justice sent a message that attackers are not immune from being targeted themselves, and I suspect it also improved morale within Stryker by showing they were, in effect, ‘striking back’.

We have seen many nation-state attacks as part of the Ukraine war targeting critical infrastructure and corporations. Many of these attacks have not had a direct impact here in Europe or on our supply chains. If there is further conflict beyond the Iran war, then the use of cyber attacks as part of hybrid warfare may increase, so organisations need to be highly vigilant in detecting and responding to these attacks, while also ensuring resilience in their operations.