Stryker says it’s restoring systems after pro-Iran hackers wiped thousands of employee devices

Stryker experienced a March 11 destructive cyberattack attributed to pro‑Iran group Handala that reportedly used access to the company’s Microsoft Intune/admin account to remotely wipe tens of thousands of employee devices, causing major operational disruption. The company says the incident was contained to its internal Microsoft environment and its internet-connected medical products are safe; investigators have found no signs of ransomware or malware, and initial access may have involved phishing or credential‑stealing tools.