Stryker wiper attack

Medical technology company Stryker disclosed a cybersecurity incident causing a global disruption to its Microsoft environment; the Iran-linked persona Handala claimed a mass device-wiping attack.

Incident ID

CP-2026-003

Incident date

11 MAR 2026

Detection date

11 MAR 2026

Affected countries

United States

Plotted location

Portage, Michigan, United States (Affected organization headquarters)

Threat classification

Level 3 — ELEVATED

Classification rationale

Destructive wiper attack on a major medical-technology manufacturer that disrupted its operations; no demonstrated widespread disruption of essential services, so held at Level 3.

Attack type

Wiper / Destructive Malware

Nature

Malicious activity

Attack vector

Reported abuse of the company's Microsoft Intune / Entra ID environment to remotely wipe devices

Sectors

Healthcare, Manufacturing

Critical infrastructure

Yes

Organizations affected

Stryker Corporation

Operational consequences

Stryker reported production shutdowns and delayed shipments that 'meaningfully' affected first-quarter 2026 results; most manufacturing sites were reported restored by late March. Handala's claims of 200,000+ wiped devices are unverified.

Estimated financial impact

Stryker did not publish an official total; an unofficial earnings-call transcript suggested about $375 million in delayed Q1 sales.

Attribution (as stated)

Claimed by Handala; the U.S. Justice Department/FBI have attributed the Handala persona to Iran's Ministry of Intelligence and Security (MOIS)

SOURCE REFERENCES

1. [1] Stryker Corp Form 8-K (cybersecurity incident)U.S. SEC · sec.gov
2. [2] Medtech giant Stryker offline after Iran-linked wiper malware attackBleepingComputer · bleepingcomputer.com
3. [3] Stryker cyberattack 'meaningfully' impacted Q1MedTech Dive · medtechdive.com

RECORD CREATED 14 NOV 2026 · LAST UPDATED 14 NOV 2026 · Threat levels are editorial assessments, not official government ratings.