Stryker Networks Disrupted in Cyberattack Claimed by Handala
Stryker said a cyberattack disrupted its Microsoft environment; a group calling itself Handala claimed responsibility and said it extracted 50 terabytes and wiped systems.
GizmodoU.S. Company Taken Offline by Cyberattack as Revenge for Missile Strike on Iranian School
Fox BusinessMedical device giant hit by global network disruption after cyberattack possibly linked to pro-Iranian group
Al JazeeraIran-linked hackers hit medical giant Stryker in retaliatory cyberattack
ABC NewsUS medical equipment company Stryker says cyberattack disrupted its global networks
Overview
Stryker said it was experiencing a global network disruption to its Microsoft environment on Wednesday after a cyberattack that disrupted Windows-based devices and user access.
A hacking persona known as Handala, which has documented ties to Tehran, claimed responsibility and said it seized 50 terabytes of data and wiped systems in retaliation for a strike that killed more than 170 people in Minab, according to the group.
Stryker said it has found no indication of ransomware or malware, believes the incident is contained, and that its teams are working rapidly to understand the impact and restore systems.
Stryker reported revenue of more than $25 billion in 2025 and said it has 56,000 employees worldwide and that its products reach more than 150 million patients across 61 countries, while the hackers claimed they affected about 200,000 systems and forced offices in 79 countries to shut.
A senior adviser at Recorded Future said the attack signals an escalation in target choice and effect and cybersecurity firms and analysts are assessing the breach's scope and potential strategic and political ripple effects.
Analysis
Center-leaning sources frame the incident as an Iran-linked escalation in cyberwarfare, emphasizing labels like "Iranian-linked" and "pro-Palestinian" and noting suspected ties to Iranian intelligence. They foreground the group's inflammatory language (e.g., 'Zionist-rooted corporation', 'demons') while treating the group's damage claims (50 TB, 200,000 systems) as unverified source content.
FAQ
Handala is an Iran-linked pro-Palestinian hacktivist group, believed to be affiliated with the Iranian regime or Ministry of Intelligence and Security, known for hack-and-leak operations, doxxing, and disruptive attacks primarily against Israeli and Gulf-region targets.
Handala claimed the cyberattack was in retaliation for a brutal attack on the Minab school in Iran that killed over 150-170 people and ongoing cyber assaults against the infrastructure of the Axis of Resistance.
The attack caused a global network disruption to Stryker's Microsoft environment, remotely wiped data from over 200,000 Windows-based systems including laptops and mobile devices, defaced login pages, shut down offices in 79 countries, and affected production in locations like Ireland.
Stryker confirmed the cyberattack, stated there is no indication of ransomware or malware, believes the incident is contained, instructed employees to disconnect devices and delete work profiles, and is working with Microsoft to restore systems while maintaining business continuity.
No direct impact on patient care has been reported; Stryker has business continuity measures in place to support customers and partners, though cybersecurity experts note potential risks to critical healthcare infrastructure.
