Stryker says it’s restoring systems after pro-Iran hackers wiped thousands of employee devices

Stryker, the prominent medical technology firm, has announced that it is in the process of recovering its computer systems and internal networks following a significant cyber incident. This attack, attributed to pro-Iranian hackers, resulted in the remote wiping of tens of thousands of employee devices, causing considerable disruption to the company's operations. This cyberattack is believed to be one of the first major incidents in the U.S. linked to the ongoing tensions arising from the Trump administration's policies in Iran. Stryker reported over the weekend that the attack, which occurred on March 11, was confined to its internal Microsoft environment and reassured that its internet-connected medical products remain secure for use. The exact cause of the breach is still under investigation, although Stryker has indicated that there is no evidence of ransomware or malware. However, the company continues to face challenges in processing orders, manufacturing, and shipping its products. The pro-Iran hacking group known as Handala took responsibility for the attack, claiming it was a reaction to a U.S. airstrike that resulted in the deaths of over 175 individuals, primarily children. Reports suggest that the hackers defaced Stryker's login pages, replacing them with their own branding. According to Bleeping Computer, the attackers may have gained entry through an internal Stryker administrator account, providing them extensive access to the company’s Windows network. They reportedly accessed the Microsoft InTune dashboards, which are designed for remote management of devices, enabling them to delete data from employee laptops and mobile phones without the use of malware. The Wall Street Journal further confirmed that the hackers focused on InTune as part of their strategy. While Stryker has not commented on the security measures in place for the compromised account, including whether multi-factor authentication was employed, it remains uncertain how the attackers initially infiltrated the network. Security experts from Palo Alto Networks have suggested that phishing may have played a role in compromising Stryker's network, while IBM has highlighted the hacking group’s history of targeting the healthcare and energy sectors with destructive attacks and phishing schemes. With a workforce of 56,000 spread across more than 60 countries, Stryker’s operational resilience is currently under severe strain.