Iran-Linked Handala Group Wipes 200,000 Stryker Corporate Devices

On March 11, 2026, Stryker Corporation suffered a massive cyberattack that crippled its internal Microsoft environment and disrupted operations across 79 countries. The attack targeted the company's Microsoft Intune management console, which hackers used to trigger remote factory resets on approximately 200,000 laptops and mobile devices. The disruption halted medical device production at a major hub in Cork, Ireland, and disabled the Lifenet electrocardiogram system used by emergency responders in Maryland.

The Handala hacking group, linked to Iran's Ministry of Intelligence and Security, claimed responsibility for the breach. Handala described the operation as retaliation for a U.S.-Israeli missile strike on a school in Minab, Iran, which reportedly killed between 150 and 175 people. The group claimed to have exfiltrated 50 terabytes of corporate data and described the event as the beginning of a new chapter in cyber warfare. Handala also claimed to have targeted Verifone, though Verifone denied any service disruption.

Stryker CEO Kevin Lobo stated the incident was contained and that no ransomware or malware was detected, emphasizing that connected medical products remain safe for patient use. Despite these assurances, the company's stock price fell by as much as 9.16% over two days. In the U.S., Senator Gary Peters criticized the administration's cyber defense policies, while Representative Bill Huizenga urged the Senate to approve funding for the Department of Homeland Security. The U.S. Department of Health and Human Services continues to assess potential impacts on patient care.