Iran-Linked Hacktivists Hit Stryker, Knocking Employees Offline Across Multiple Countries

A suspected Iran-linked hacktivist group, Handala, claims to have infiltrated Stryker’s network on March 11, exfiltrating data and deploying destructive wiper activity that reportedly resulted in mass MDM-driven device wipes, defacement of the Microsoft Entra portal, and operational outages across the company’s global Microsoft environment; employees in multiple countries reported remote resets and loss of access to internal systems. Stryker has acknowledged widespread disruption but says it has found "no indication of ransomware or malware" to date and is working with external cybersecurity experts to investigate and restore services.