Background and Timeline: On March 11, 2026, U.S. medical technology giant Stryker suffered a massive cyberattack that shut down its computer systems. By March 19/20, the Iran-linked activist collective “Handala” officially claimed responsibility for the operation. The attack resulted in global disruption to the company’s Microsoft environment, forcing several corporate offices to close temporarily.

Modus Operandi: Handala hackers reportedly gained access to a Microsoft Intune device management console using compromised administrator credentials. They then issued a remote wipe command that affected thousands of employee devices worldwide, causing them to factory reset. Stryker clarified that the incident did not involve ransomware but used a malicious file to hide activity and execute commands without spreading to customer environments.

Victims and Financial Impact: The attack caused global disruption to Stryker’s internal operations, though the company stated its surgical robotics and life support monitors remained safe to use. Handala claimed to have exfiltrated large amounts of sensitive data before triggering the remote wipe. The financial damage includes the massive cost of device restoration and the potential loss of sensitive corporate strategy documents.

Investigation and Agencies Involved: The FBI and CISA actively engaged with Stryker, and the DOJ announced on March 19 the seizure of four internet domains operated by Iran’s MOIS, including two tied to the Handala persona. CISA issued an emergency alert urging all U.S. organizations to harden their Microsoft Intune environments following the breach. Investigators are mapping the Handala group’s links to state intelligence agencies.

Arrests and Suspects: No arrests have been made, as the Handala collective operates from overseas jurisdictions. However, the court-authorized seizure of Handala-Hack[.]to and other domains represents a significant blow to their communication infrastructure. The suspects are believed to be linked to Iran’s Ministry of Intelligence and Security (MOIS), framing the attack as retaliation for a U.S. airstrike.

Broader Implications and Trends: The Stryker incident underscores the vulnerability of specialized medical technology infrastructure to geopolitically motivated “non-ransomware” attacks. It highlights that “availability” and “data integrity” are now primary targets for state-linked hacktivists. This case reinforces the need for organizations to secure endpoint management systems (MDM) to prevent privileged access abuses.