Pro-Iran hacktivist group says it is behind attack on medical tech giant Stryker

A group of hackers with ties to Iran has claimed responsibility for a significant cyber intrusion into the systems of U.S. medical technology firm Stryker. This attack has reportedly caused widespread disruptions across the company’s operations internationally. As of Wednesday morning, numerous systems within Stryker have been rendered inoperable, with some login interfaces displaying the hackers' emblem instead of the usual access pages. The hacktivist group, identified as Handala, announced their involvement through a message on an X account believed to be associated with them. They stated that the motivation behind this attack stemmed from a desire for retaliation against what they termed as the brutal assault on the Minab school, along with ongoing cyberattacks targeting Iran and its allies. The Minab incident references a U.S. military strike in Tehran that purportedly resulted in the deaths of over 175 individuals, many of whom were children. Notably, Stryker, which specializes in the production of medical devices for healthcare facilities, does not have any direct connections to these military actions, although it operates in Israel and secured a $450 million contract with the U.S. Department of Defense last year. According to the hackers, the operation has led to the wiping of over 200,000 devices, servers, and mobile systems, alongside the extraction of 50 terabytes of critical information. They claimed that Stryker's offices in 79 different countries have been forced to cease operations. Reports from The Wall Street Journal lend some credibility to these claims, indicating that several of Stryker’s systems worldwide have indeed been compromised. In response, a spokesperson for Stryker assured that their teams are working diligently to restore functionality and maintain service for their customers. An internal notice to employees described a severe disruption affecting the Windows environment, significantly hampering access to systems and services. The U.S. Cybersecurity and Infrastructure Security Agency, which is tasked with addressing cyber threats, has yet to comment on this incident. Handala emerged following the October 7 attacks by Hamas on Israel and has been actively targeting Israeli civilian infrastructure, energy sectors in the Gulf, and Western entities. According to the IBM X-Force Exchange, the group’s tactics include a range of cyber methods such as phishing, wiper malware, ransomware-style extortion, and data theft, often accompanied by ideological messaging. Additionally, Handala operates a website that publicly identifies dozens of individuals allegedly linked to the Israeli Defense Forces and local defense contractors. A recent report from Israeli cybersecurity firm Check Point noted that since the onset of the conflict in Iran, Handala has been effectively breaching vulnerable systems and strategically timing the release of stolen data to amplify pressure on their targets.