Medical Device Manufacturer Hack Was Likely Opportunistic
An Iranian hack on medical device maker Stryker’s internal Microsoft environment does not appear to affect the company’s connected products used by its healthcare clients. But a resulting outage of the manufacturer’s electronic ordering system could lead to supply chain issues for its customers, depending upon how long services are offline, some experts warn.
See Also: Free Your IT Program of Tech Debt With an Enterprise Browser (eBook)
Stryker is “working closely with our global manufacturing sites to manage operations and mitigate potential impacts” the company said on Sunday in an update about the attack. Stryker is among the top global manufacturers of medical devices, earning $22.6 billion in sales in 2024, producing equipment that spans robotic surgery systems to hospital beds.
A hacking group going by “Handala” claimed responsibility last Wednesday for a wiper attack that caused Michigan-based Stryker to global systems outage disruption. The attack caused some mobile devices to be wiped,and some log-in screens replaced with the Handala logo. Handala is widely suspected of being a hacktivist front for Iran’s Ministry of Intelligence (see: Medtech Firm Stryker Disrupted by Pro-Iran Hackers).
The company has said the attack did not involve ransomware and that the incident is believed contained. A newly registered account on social platform X, apparently run by Handala, claimed the Stryker attack as retribution for the ongoing U.S. and Israeli bombing campaign n Iran – and especially as revenge for a strike that hit an elementary school in the southern Iranian town of Minab.
Threat intel firm Cisco Talos said Friday the Stryker hack was likely opportunistic rather than targeted and that the healthcare sector faces no elevated risk from ongoing attacks.
“We make this assessment with high confidence based on our understanding of the motivation and capability of threat groups like Handala, which have historically compromised targets of opportunity. Talos has not observed any recent increase in systematic or elevated targeting of healthcare or health care-adjacent sectors over any other industry,” it said.
But hacking a healthcare sector firm is nonetheless highly symbolic. “It’s like going after water plants and power plants – those sustain life,” Jeff Thomas, CTO of Sentara Health, told Information Security Media Group (see: Inside the Tehran-Linked ‘Faketivist’ Hacking Group Handala).
So far, hospitals and other healthcare providers do not appear to be reporting major disruptions to product availability as a result of the Stryker incident, but that could change, some experts said.
“What we are hearing from clients is more operational friction than full supply interruptions; things like delays in vendor communication, uncertainty around ordering systems, or slower support response while Stryker stabilizes internal systems,” said Jackie Mattingly, senior director of consulting at Clearwater, and a former long-time hospital CISO.
Stryker products already deployed in clinical settings not touched by the hack, said Jason Sinchak, CEO and co-founder of Elton, a medical device cybersecurity firm. But should Stryker supplies stall or run out, the incident could still affect patients, he said.
Some surgeons only want to use specific products, such as a particular implantable device from a preferred vendor for certain patient procedures, “because they know how it works,” Sinchak said. “If the product isn’t available, procedures get canceled, delayed. So, it has an instant impact on the healthcare delivery process.”
“I’ve always noticed from device manufacturers that they are very, very heavy on security for their products and the regulated aspect,” Sinchak said. But their internal IT enterprise security could be a different story, he said. “The enterprise is not regulated, obviously. And so, historically, that has always been a pretty weak spot,” he said.
Stryker did not immediately respond to Information Security Media Group’s request for comment.
Previous healthcare sector catastrophes – including the COVID pandemic, which resulted in shortages of medical supplies such as protective gear – and more recently the February 2024 Change Healthcare ransomware attack, which caused massive workflow disruptions to thousands of medical care providers for months – have helped to better acclimate hospitals and clinics for operating under severe crises, Mattingly said.
Hospitals are better used to managing supply variability, especially after the pandemic, she said. “Most organizations are doing a few simple things. First, they are checking current inventory levels for any products sourced primarily from Stryker. Second, supply chain teams are identifying alternate suppliers where possible, even if they are not immediately needed,” she said.
Hospitals should communicate internally with clinical teams so they are aware of the situation and can plan accordingly, she said. “Healthcare supply chains are resilient because they have had to be. The key is early visibility, not last-minute scrambling,” she said.
The Change Healthcare incident was a “wake-up call” for the entire industry because it showed how dependent healthcare operations are on third-party platforms, she said. “When claims processing stopped, hospitals immediately felt the financial and operational pressure,” she said.
Since then, healthcare organizations tend to take vendor risk more seriously, she said. “Many have expanded their third-party risk management programs, incorporated vendor outage scenarios into tabletop exercises, and started asking deeper questions about how critical services would continue if a key partner experienced a cyber incident,” she said.
Nonetheless, any long disruption or delay in Stryker order fulfillment would not be welcome news to their end user customers, or the middlemen in-between, Sinchak said.
“People that resell Stryker products – they’re all kind of scared of the same thing: ‘I can’t sell anything, because it’s not going to ship,’ which means we can’t do this operation that’s scheduled next week, or whatever,” Sinchak said.
The situation at Stryker has other medical device makers and similar healthcare sector entities on edge, he said. “They’re telling us they are freaked out about the attack, as you can imagine,” he said. “So, they are aggressively now evaluating their own enterprise security situations.”
With reporting from Information Security Media Group’s Mathew J. Schwartz in Scotland.