Medtech Firm Stryker Disrupted by Pro-Iran Hackers

Michigan-based Stryker just after midnight East Coast time on Wednesday experienced an organization-wide systems outage disruption, including some mobile devices being wiped, and some log-in screens replaced with the logo of Handala, as first reported by The Wall Street Journal.

See Also: The Healthcare CISO’s Guide to Medical IoT Security

The attack appears to be a direct reprisal for the “major combat operations” launched by the United States and Israel against Iran on Feb. 28.

A newly registered account on social platform X, apparently run by Handala, claimed its Stryker disruption affected 79 offices across the world, resulting in “over 200,000 systems, servers and mobile devices” being wiped and 50 terabytes of data stolen. Stryker is among the top global manufacturers of medical devices, earning $22.6 billion in sales in 2024, producing equipment that spans robotic surgery systems to hospital beds.

Threat intelligence service FalconFeeds reports that Handala appears to be a “faketivist” group linked to Iran’s Ministry of Intelligence, specializing in deniable operations (see: Cyberattacks and Unpredictable Targeting Remain an Iran Risk).

Publicly traded Stryker’s European headquarters in Cork, Ireland, confirmed it’s been disrupted, and the National Cyber Security Center in Dublin is responding, reported the Irish Examiner. Stryker counts about 5,000 employees in Ireland, the newspaper reported.

Based in part on details being posted to social media, British cybersecurity expert Kevin Beaumont said in a post to social network Mastodon that the attackers appeared to have gained access to the organization’s Active Directory services “and wiped all the devices with Intune,” which is Microsoft’s endpoint management tool, used in part to enforce bring-your-own-device security policies.

“My wife had 3 Stryker managed devices wiped around 3:30 a.m. EDT. Their Entra login page was defaced with the Handala logo, it’s still up as of this post,” reads a Monday Reddit post.

Other social media posts – none of their authenticity could be confirmed – badged as being from Stryker employees in Michigan said they were being sent home from work, owing to system outages.

“Stryker is experiencing a global network disruption to our Microsoft environment as a result of a cyberattack. We have no indication of ransomware or malware and believe the incident is contained,” the company said in a statement distributed to multiple media outlets.

“Our teams are working rapidly to understand the impact of the attack on our systems. Stryker has business continuity measures in place to continue to support our customers and partners,” it said.

Iranian Bank Outages

Inside Iran, infrastructure tied to two of the biggest state-owned banks appears to be non-functional, although whether that might trace to a missile or cyberattack remains unclear.

Reports first surfaced Tuesday that staff at the banks weren’t able to access systems. Websites for both banks are offline, and customers can’t withdraw funds or contact customer support. The outage of Bank Sepah is notable in part because it pays military personnel salaries, said British-based Iranian activist Nariman Gharib.

Unconfirmed reports suggested the bank outages were the result of a cyber operation. But Gharib suggested the outages instead tied to a missile attack that reportedly hit Bank Sepah’s data center in Tehran, at about 1 a.m. local time on Tuesday.

The state-affiliated news agency ISNA confirmed the outages but suggested it was voluntary, saying the “suspension of key banks was a response to the urgent need to protect vital resources,” reported Euractiv.

Self-Proclaimed Hacktivist Activity

Since the United States and Israel launched their war against Iran on Feb. 28, cybersecurity experts initially saw scant signs of any cyberattack reprisals by Tehran, barring the hacking of IP cameras, likely missile targeting and battlefield intelligence.

Proxies outside of Iran mobilized a “massive cyber campaign” badged as “#OpIsrael,” with multiple supposed hacktivist groups claiming to be targeting critical infrastructure inside neighboring states allied with the U.S., including Bahrain, Jordan and Kuwait, threat intelligence firm Flashpoint reported.

The groups involved have included Fatemiyoun Electronic Team, Cyber Islamic Resistance (Team 313) and the pro-Russian NoName057(16), as well as Handala Group, which draws its name from a cartoon Palestinian boy and emerged in 2023 with pro-Palestinian messaging.

As with NoName057, which has apparent ties to Russia’s intelligence establishment, Handala appears to be run by Iran’s intelligence ministry. “Rather than chasing zero-days, the actor excels at psychological impact: high-visibility breaches, theatrical claims and timed leaks that turn stolen data into strategic messaging,” FalconFeeds said.

In its Wednesday post to X, Handala said: “We announce to the world that, in retaliation for the brutal attack on the Minab school and in response to ongoing cyber assaults against the infrastructure of the Axis of Resistance, our major cyber operation has been executed with complete success.”

On Feb. 28, a school in the southern town of Minab was hit by an airstrike that killed 170 people, many of them children. NBC News reported that a U.S.-made Tomahawk missile appears to have struck near the school.

The choice of Stryker as a target may have to do with where the business operates. The publicly traded company has acquired multiple businesses in Israel, including orthopedic device maker OrthoSpace for $220 million in 2019.

Handala has also been tied to two other recent attacks. On Monday, the group announced the leak of “50 senior Israeli Air Force officers’ information,” including their name, address, phone number, photograph and job description. The same day, it also claimed to have seized control of government-run security cameras across Jerusalem.

When attackers first infiltrated Stryker’s systems, and if it might predate the Feb. 28 start of U.S.-Israel and Iran conflict, isn’t clear. Nation-state hackers often preposition themselves inside an organization.

Iran Expands Targets

Iranian officials announced Wednesday that they’re expanding targeting to include any economic centers or banks tied to the United States or Israel, as well as American firms in the region that have ties to the U.S. military or Israel.

“In an escalatory move, Iranian officials warned civilians in the region to maintain a one-kilometer radius from any such banking facilities,” Flashpoint said.

The semi-official Tasnim news agency, associated with Iran’s Islamic Revolutionary Guard Corps, said that “Iran’s new targets” now include Amazon and its AWS cloud infrastructure, Google, IBM, Microsoft, Nvidia, Oracle and Palantir (see: Amazon Says Drone Strikes Disrupted Middle East Data Centers).

The IRGC on Wednesday also claimed to launch missile attacks against U.S. bases in Kuwait, Iraq and Qatar. It’s also continued to target oil refineries or facilities in the United Arab Emirates and Israel, leading Tuesday to the closure of Ruwais in Abu Dhabi – the Middle East’s largest oil refinery.

The UAE Ministry of Defense on Tuesday reported that in the prior 24 hours, air defenses intercepted 262 ballistic missiles and 1,385 unmanned aerial vehicles, with two of the missiles and 90 drones striking its territory. The attacks led to six people being killed and 122 injured.

Saudi Arabia and Oman also reported shooting down multiple missiles or drones on Tuesday.

Uncertainty over global oil supplies, resulting from the conflict, has rattled financial markets. Tanker traffic has plummeted in the Strait of Hormuz, through which about one-fifth of the world’s oil supply typically travels on approximately 100 ships per day. Iran attacked three ships in the strait on Wednesday, after which Tehran declared that it would “not allow even a single liter of oil” to pass through if it was destined for the United States, Israel or their allies.

The apparent escalation in hostilities followed U.S. President Donald Trump on Monday declaring that the war would be over “soon.”

His press secretary on Tuesday clarified that the conflict will continue until Trump determines that “Iran is in a place of unconditional surrender, when they no longer pose a credible and direct threat to the United States of America and our allies.”