US medtech giant Stryker confirms a global outage due to a cyberattack; Iran-linked group Handala says the hack is retaliation for a strike on a school in Iran

The U.S. medtech company experiences a global outage, with some staff devices remotely wiped — Medical technology giant Stryker …

Wall Street Journal 2026-03-12 James Rundle

Context & Ripple Effects

Earlier coverage established that Stryker's disruption included suspicious login-page imagery seen by staff and contractors. The company's confirmation converts that initial reporting into an acknowledged enterprise outage, while Handala's stated rationale remains a claim of responsibility rather than independent attribution.

Subsequent reporting tied the incident to an apparent remote-wipe action through Microsoft Intune, and CISA later urged organizations to harden the access-management tool after the Stryker attack. That makes this more than a conventional availability incident: endpoint-management controls are central to both recovery and prevention.

First-order effects

Stryker must restore affected systems and staff devices while containing any remaining unauthorized administrative access; the reported wiping of endpoints can extend disruption beyond a single service outage.
Handala's retaliation claim gives the incident an overt geopolitical narrative, requiring Stryker and affected stakeholders to distinguish the group's public assertions from verified forensic attribution.

Second-order effects

Organizations using comparable endpoint-management setups face renewed pressure to review privileged access and vendor guidance, especially after CISA's warning to fortify Intune.
Medtech customers and partners may scrutinize Stryker's operational resilience and recovery communications, since a global corporate outage can affect coordination even when the report does not establish impacts on specific products or care settings.

Third-order effects

If politically motivated groups continue to use destructive techniques against commercial health-sector suppliers, cyber resilience will become a more prominent procurement and governance issue across the medical-technology supply chain.
The episode extends a pattern in which disruption at healthcare-adjacent organizations can persist: Ascension's earlier prolonged outage showed how cyber incidents can become operational crises, though the two attacks' methods and motives are not established as the same.

The trend: Geopolitical hacktivism is increasingly intersecting with enterprise endpoint-management risk, raising the stakes for resilience at healthcare and medtech suppliers.

Discussion

NewsMax.com Nicole Weatherholtz on x
Iran-Linked Hackers Claim Stryker Cyberattack
@hprnew @hprnew on x
HELLO Stryker #HANDALA [image]
@juliettekayyem Juliette Kayyem on x
We've heard military analysts talk about the degradation of Iranian capabilities. Unmm... Iran has many tools for disruption. Close a canal, launch terror, attack cyber networks. This is the war too⬇️
@taylorkenneyitm Taylor Kenney on x
@SaltyMongrel i can confirm this is very real, as my husband works for stryker and his phone has been wiped and our data is in their hands. [image]
@seanmccarthycom @seanmccarthycom on x
It seriously damages us as a society when the revelation that our government double tapped an elementary school is something we move on from.
@kimzetter Kim Zetter on x
The hackers say they targeted Stryker in retaliation for US bombing of all-girls school in Iran. They say they have wiped more that 200,000 Stryker systems, servers, and mobile devices and stole 50 terabytes of critical data, forcing Stryker offices in 79 countries to shut down
@kane @kane on x
What are the chances the Iranian hackers accidentally thought Stryker (medical devices) made the Stryker (armored fighting vehicle)
@cormacjokeeffe Cormac O'Keeffe on x
Comment from Stryker: “We are currently experiencing a global network disruption affecting the Windows environment. Our teams are actively working to restore systems and operations. Stryker has business continuity measures in place, and we're committed to serve our customers.”
@kimzetter Kim Zetter on x
US medical device maker Stryker hit with cyberattack from Iranian hacktivists who remotely wiped employee devices. “many employees have had their device data wiped and cannot access their accounts” Stryker makes surgical/imaging equipment, defibrillators https://www.corkbeo.ie/..…
@cormacjokeeffe Cormac O'Keeffe on x
A global medical technology company — with up to 5,000 employees in Ireland and headquartered in Cork — has been crippled by a cyber attack suspected of being carried out by an Iranian-backed group https://www.irishexaminer.com/ ...
@wbm312 Whitney Merrill on bluesky
Reason #37482 why you should NEVER let your employer put MDM on your personal device and you should instead opt for a second work phone. — krebsonsecurity.com/2026/03/ iran...
r/cybersecurity r on reddit
Stryker Hit With Suspected Iran-Linked Cyberattack - WSJ
r/technews r on reddit
Medtech giant Stryker offline after attack claimed by Handala, an Iran-linked wiper malware attack
r/technology r on reddit
Stryker Hit With Suspected Iran-Linked Cyberattack
r/StockMarket r on reddit
Stryker Hit With Suspected Iran-Linked Cyberattack
@borzou Borzou Daragahi on x
Iran's cyber attacks have begun. Experts have long warn Iran would unleash such capabilities in case of all-out war
@mattjay Matt Johansen on x
Saw this text floating around before the story broke [image]
@marxistheathen @marxistheathen on x
whether or not it was intended this way, this feels like a warning shot that isn't too awful on its own but makes it clear the future can be made to look absolutely catastrophic if the US continues course
@specialsitsnews @specialsitsnews on x
Iranian hackers say they wiped 200,000 devices at US medical company $SYK Stryker, forcing closure of offices An Iran-linked hacking group (Handala) claimed it had extracted 50 terabytes of data in retaliation for military strikes (girl's school) https://x.com/... [image]
@patrickhowelloneill.com Patrick Howell O'Neill on bluesky
The medical equipment giant Stryker confirmed they are experiencing a “global network disruption” that comes “as a result of a cyber attack.” Pro-Iranian hacking group Handala claimed responsibility. Workers were sent home, devices wiped. www.bloomberg.com/news/article...
r/news r on reddit
Iran-linked hackers attack US medical device maker Stryker
r/BMET r on reddit
Stryker got hacked
r/worldnews r on reddit
Stryker shares fall after report on suspected Iran-linked cyberattack
r/politics r on reddit
Pro-Iran hackers claim cyberattack on major US medical device maker
@gwartygwart @gwartygwart on x
Why don't they just tokenize the oil in the Middle East and transport it across permissionless financial rails, thereby avoiding the Strait of Hormuz altogether
r/PrepperIntel r on reddit
Medtech giant Stryker offline after attack claimed by Handala, an Iran-linked wiper malware attack
r/TrueAnon r on reddit
Medtech giant Stryker offline after attack claimed by Handala, an Iran-linked wiper malware attack

Chronicles