Stryker Corporation Hit by Cyberattack as Hackers Claim System Breach and Device Wipe

Global medical technology company Stryker experienced a major cyberattack on March 11, 2026, forcing widespread shutdowns across its worldwide IT infrastructure.

The attack, which security experts believe is linked to Iranian-backed threat actors, deployed destructive wiper malware that erased corporate data and disrupted critical systems across the company’s network.

The breach significantly impacted Stryker’s global operations, particularly at its headquarters in Cork, Ireland, where thousands of employees were unable to access internal systems.

Manufacturing, engineering, and internal communications tools were reportedly affected as the attack spread through the corporate environment.

Following the incident, Stryker’s internal cybersecurity teams launched an emergency response effort alongside Microsoft engineers to investigate and contain the intrusion.

Early assessments suggest the attackers were not financially motivated, as the operation focused on destroying data rather than deploying ransomware or demanding payment.

Handala Hacktivist Group Linked to Attack

Cybersecurity researchers have attributed the attack to the hacktivist group Handala, a pro‑Palestinian collective widely believed to have links to Iranian state-backed cyber operations.

The group has previously carried out politically motivated attacks targeting organizations they consider strategically important.

Unlike traditional cybercriminal groups that seek financial gain through ransomware campaigns, Handala’s operations focus on disruption and political messaging.

In the Stryker attack, the threat actors reportedly compromised high-level administrative accounts to gain deep access into the company’s internal systems.

Once inside the network, the attackers defaced system login pages and displayed the Handala logo to publicly claim responsibility for the breach.

This tactic is often used by hacktivist groups to showcase their success and reinforce the political message behind their operations.

The attackers deployed sophisticated wiper malware designed to permanently destroy data across corporate systems.

Unlike ransomware, which encrypts files for payment, wiper malware intentionally deletes information to make recovery impossible.

The malware leveraged internal device management infrastructure to execute widespread destruction across endpoints and servers.

According to early incident reports, the malware targeted both corporate and mobile devices connected to the enterprise environment.

Key technical impacts reported during the attack include:

• Complete deletion of data from Microsoft Intune‑managed devices, affecting workstations and personal smartphones enrolled in corporate management.
• Shutdown of internal servers and proprietary enterprise applications across Stryker’s global network.
• Remote wiping of mobile devices linked to company email accounts and internal systems.
• Defacement of administrative login portals with the Handala branding.

The attack has significantly disrupted Stryker’s daily operations across North America, Europe, and Asia.

The Cork headquarters was particularly affected, with more than 5,500 employees unable to access engineering platforms and product development systems.

Manufacturing processes and internal logistics systems were also interrupted, raising concerns about delays in the production and distribution of critical medical equipment.

Industry experts warn that prolonged downtime could impact global supply chains for medical devices used in hospitals and healthcare facilities.

As Stryker and Microsoft continue recovery efforts, the incident highlights the growing risk posed by destructive cyberattacks targeting critical healthcare and medical technology infrastructure.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.

The post Stryker Corporation Hit by Cyberattack as Hackers Claim System Breach and Device Wipe appeared first on Cyber Security News.