Meridiano

Add Article

No Image Available

Article Details

Title

Article: The who, what, and why of the attack that has shut down Stryker's Windows network"

Impact Score

6 / 10

AI Summary (Processed Content)

A cyberattack claimed by the Iranian-aligned Handala Hack group has disrupted the global Microsoft environment of medical device maker Stryker. The attack, which wiped employee devices, occurred following warnings of retaliatory hacks after recent U.S. and Israeli airstrikes on Iran.

Stryker states the incident is contained and that critical medical devices remain functional, but the company has no timeline for a full recovery. The attackers did not use typical ransomware or malware, according to the company's investigation.

The main topics covered are the cyberattack on Stryker, its attribution to an Iranian-aligned group, the geopolitical context of recent airstrikes, the impact on the company's operations, and the status of critical medical devices.

Original URL

https://arstechnica.com/security/2026/03/whats-known-about-wiper-attack-on-stryker-a-major-supplier-of-lifesaving-devices/

Source Feed

Ars Technica

Published Date

2026-03-12 22:18

Fetched Date

2026-03-12 19:30

Processed Date

2026-03-12 19:31

Embedding Status

Present

Cluster ID

Not Clustered

Raw Extracted Content

Within hours of the US and Israel launching airstrikes on Iran two weeks ago, security professionals warned organizations around the world to be on heightened watch for destructive retaliatory hacks. On Wednesday, the predictions appeared to come true as Stryker, a multinational maker of medical devices, confirmed a cyberattack that took down much of its infrastructure, and a hacking group long known to be aligned with the Iranian government claimed responsibility.
Where things stand
When and how did the attack come about?
The first indications were social media posts and a report from a news organization in Ireland. Messages posted by purported Stryker employees or their family members on social media said workers’ phones and computers had been wiped. A report the Irish Examiner published Wednesday morning, citing multiple anonymous sources, made the same claims and said some employees witnessed login pages on wiped devices displaying the logo of Handala Hack, a group that researchers who have followed it for years say is aligned with the Iranian government.
What is the status now?
Stryker said Thursday that it’s in the midst of responding to a “global network disruption to our Microsoft environment as a result of a cyber attack.” The update went on to say responders have no indication that ransomware or malware—the usual causes for such outages—were involved. The responders believe the incident is now contained and limited to the internal Microsoft environment.
The company did say that Lifepak, Lifenet, and Mako devices—which medical professionals use to monitor for and control heart attacks, manage and transmit patient information in real time, and perform surgeries—were all functioning normally. In a Securities and Exchange Commission filing on Wednesday, Stryker said it had no timeline for recovering normal day-to-day activities.