TL;DR
- On March 11, 2026, Iran-linked Handala group wiped 200,000+ Stryker devices globally via compromised Microsoft Intune console
- Attack disrupted healthcare supply chains in 79 countries, forcing hospitals to suspend surgical supply orders and EKG transmission services
- Handala claimed retaliation for U.S. missile strike on Iranian school (Feb 28), targeting Stryker's military and Israeli business ties
- Personal employee devices were wiped, including eSIMs and personal data, demonstrating the danger of MDM over-reach
What Happened During the Stryker Cyberattack?
On March 11, 2026, at approximately 3:30 AM EDT, Stryker Corporation experienced a catastrophic cyberattack that wiped over 200,000 devices across 79 countries [1]. The attacker, Handala (also known as Handala Hack Team), gained access to Stryker's Microsoft Intune mobile device management console and executed a coordinated remote wipe operation that paralyzed the medical device manufacturer's global operations [2].
Get Our Weekly Cybersecurity Digest
Every Thursday: the threats that matter, what they mean for your business, and exactly what to do. Trusted by SMB owners across Australia.
No spam. No tracking. Unsubscribe anytime. Privacy
Stryke
Free Resource
Weekly Threat Briefing — Free
Curated threat intelligence for Australian SMBs. Active campaigns, new CVEs, and practical mitigations — every week, straight to your inbox.
Subscribe Free →Before executing the wipe, Handala defaced Stryker's Microsoft Entra login page with their signature logo—a barefoot Palestinian child holding a slingshot, based on cartoonist Naji al-Ali's iconic character [4]. This psychological warfare tactic is consistent with Void Manticore's operational playbook, the Iran Ministry of Intelligence and Security (MOIS)-linked parent group behind Handala [5].
How Did Handala Compromise Microsoft Intune?
The attack vector exploited Stryker's reliance on Microsoft Intune for enterprise device management [2]. According to cybersecurity researchers at Palo Alto Networks Unit 42, Void Manticore groups typically gain initial access through unpatched web servers, vulnerable VPN gateways, or compromised remote access solutions [6]. Once inside the network, attackers use PowerShell scripts, scheduled tasks, and living-off-the-land techniques to achieve lateral movement and establish persistence [6].
In Stryker's case, the attackers likely maintained quiet access for weeks or months before executing the destructive payload [5]. This pattern matches Void Manticore's standard operational timeline: establish foothold, conduct reconnaissance, exfiltrate data, then deploy wiper malware at maximum impact timing [6]. Handala claimed to have exfiltrated 50 terabytes of data, though this remains unverified as of March 13, 2026 [2].
The Microsoft Intune compromise represents a particularly dangerous attack surface. Intune consoles have administrative control over every enrolled device, allowing remote wipe, policy enforcement, and application deployment [7]. When attackers compromise these management platforms, they inherit god-mode access to an organization's entire device fleet—corporate laptops, phones, tablets, and in Stryker's case, personal devices enrolled through BYOD policies [1].
Why Did Handala Target Stryker Corporation?
Handala explicitly stated their motivation: retaliation for a February 28, 2026 U.S. Tomahawk missile strike on a school in Minab, Iran, that killed over 175 people, primarily children [2]. The group positioned the Stryker attack as punishment for perceived American aggression against Iranian civilians [4].
Stryker became a target due to two specific business relationships that connected the company to U.S. military and Israeli interests [3]. First, Stryker holds a $450 million military medical equipment contract with the U.S. Department of Defense signed in 2025 [2]. Second, Stryker acquired OrthoSpace, an Israeli orthopedic device company, in 2019, creating a business connection to Israel that Iran-linked threat actors frequently cite as justification for targeting [8].
According to Check Point Research, Handala and its parent organization Void Manticore have consistently targeted entities with perceived connections to Israel or U.S. military operations since the group's emergence in December 2023 [4]. Previous Handala operations include compromising Israeli military servers, breaching Jerusalem municipal security camera feeds, doxxing Israeli military officers, and disrupting fuel distribution systems in Jordan [5].
What Is the Healthcare Impact of This Attack?
The Stryker attack created immediate disruptions to hospital supply chains across the United States and globally [1]. Stryker manufactures surgical equipment, orthopedic implants, Mako surgical robots, Vocera communication systems, and LIFEPAK defibrillators—products used in nearly every hospital that performs surgical procedures in the United States [2].
Healthcare providers reported inability to order replacement surgical supplies through normal procurement channels during the outage [1]. The American Hospital Association issued a monitoring statement acknowledging the disruption: "That may change as the duration of the attack extends," indicating concern about prolonged supply chain impact [9].
In Maryland, emergency medical services faced a critical operational challenge when hospitals suspended LifeNet EKG transmission connections [2]. LifeNet enables paramedics to transmit electrocardiogram readings from ambulances directly to hospital emergency departments, allowing cardiologists to diagnose heart attacks in transit and prepare intervention teams before patient arrival [10]. With LifeNet connections severed, Maryland EMS agencies issued emergency protocol changes requiring manual EKG interpretation by paramedics and delayed cardiac care coordination [2].
Stryker filed an SEC 8-K disclosure documenting the incident as required for publicly traded companies experiencing material cybersecurity events [3]. As of March 13, 2026, the company had not provided a timeline for full restoration of systems or quantified the financial impact of the attack [1].
ISO 27001 SMB Starter Pack — $97
Threat intelligence is one thing — having the policies and controls to respond is another. Get the complete ISO 27001 starter kit for SMBs.
Get the Starter Pack →Who Is Handala and What Are Their Capabilities?
Handala first appeared in December 2023 and operates as a sub-group within Void Manticore, an Iran Ministry of Intelligence and Security (MOIS)-linked cyber operation focused on psychological warfare and reputational damage [4]. Cybersecurity researchers at Cyble Research and Intelligence Labs identified infrastructure and tooling overlaps between Handala and MuddyWater, another established MOIS-affiliated threat group [5].
The group operates custom wiper malware variants named "Hatef" and "Hamsa" capable of destroying data on both Windows and Linux systems [4]. According to Sophos researcher Rafe Pilling, Handala's phishing campaigns combine Rhadamanthys infostealer malware with their custom wipers, allowing simultaneous data exfiltration and system destruction [11].
Handala demonstrates sophisticated operational security by routing reconnaissance traffic through Starlink IP addresses, frustrating network defenders attempting to implement geographic IP blocks against Iranian infrastructure [5]. This technique leverages the distributed, satellite-based nature of Starlink to obscure true attack origin and complicate attribution efforts [12].
The group's naming references Handala, a barefoot Palestinian refugee child character created by political cartoonist Naji al-Ali in the 1960s [4]. The character symbolizes Palestinian resistance and appears in all Handala group defacements, representing the group's framing of cyberattacks as political resistance against Western and Israeli interests [8].
What Does This Mean for Enterprise Device Management Security?
The Stryker incident exposes systemic vulnerabilities in enterprise mobile device management architecture [7]. Organizations implementing BYOD (Bring Your Own Device) policies through platforms like Microsoft Intune create a concentrated attack surface where single administrative account compromise grants access to thousands of endpoints [2].
Stryker employees who enrolled personal devices in Company Portal to access corporate email experienced complete device wipes that destroyed personal photos, contacts, and even eSIM cellular configurations [1]. This collateral damage highlights the privacy and security tradeoffs inherent in MDM enrollment that many users do not fully understand when accepting BYOD policies [13].
According to Microsoft's own security guidance, Intune administrative accounts require multi-factor authentication, Conditional Access policies, and Privileged Identity Management with just-in-time elevation [7]. Organizations should implement administrative tier separation where Intune admins cannot access production workloads and vice versa, preventing lateral movement from compromised endpoints to management consoles [14].
The attack demonstrates the importance of backup device management infrastructure and disaster recovery planning for MDM platforms [7]. Organizations relying solely on cloud-based device management without offline recovery procedures face total operational paralysis when attackers compromise those systems [2].
How Can Organizations Protect Against Wiper Attacks?
Defense against wiper attacks requires layered security controls focused on preventing initial access, detecting lateral movement, and maintaining offline recovery capabilities [6]. The CISA Cross-Sector Cybersecurity Performance Goals recommend implementing phishing-resistant multi-factor authentication, network segmentation, and comprehensive audit logging as foundational controls [15].
Organizations should implement privileged access workstations (PAWs) for administrative accounts managing critical infrastructure like MDM platforms [14]. PAWs are hardened, internet-isolated systems used exclusively for administrative tasks, preventing credential theft from phishing or malware on standard corporate endpoints [16].
Network segmentation limits attacker lateral movement by restricting communication between network zones [6]. Administrative networks hosting management consoles should have strict firewall rules allowing only necessary connections from jump servers or PAWs, not general corporate networks where initial compromise typically occurs [14].
Offline, immutable backups stored outside the production network provide recovery capability after destructive attacks [15]. Organizations should test restore procedures quarterly and maintain offline copies of critical configuration data, including device enrollment records and management platform settings [16].
Security teams should monitor for anomalous administrative activity in MDM platforms, including bulk device wipes, policy changes affecting large device populations, or administrative logins from unusual locations or times [7]. SIEM correlation rules detecting these patterns enable rapid response before attackers execute destructive payloads [16].
FAQ
A wiper attack uses malware designed to permanently destroy data on infected systems by overwriting storage media or corrupting file systems. Unlike ransomware, which encrypts data for extortion, wipers aim for pure destruction without recovery options. Handala's Hatef and Hamsa wiper variants target both Windows and Linux systems, making them effective against diverse enterprise environments.
Handala wiped over 200,000 devices globally through Stryker's compromised Microsoft Intune console on March 11, 2026. This included corporate laptops, mobile devices, and personal employee devices enrolled through BYOD policies. The attack affected operations in 79 countries where Stryker maintains facilities.
Iran-linked threat groups like Handala target organizations based on perceived political or military connections rather than industry sector. Stryker became a target due to its $450 million U.S. Department of Defense medical equipment contract and 2019 acquisition of Israeli company OrthoSpace. The healthcare impact was collateral damage in a politically motivated attack.
Like any administrative platform, Microsoft Intune can be compromised if attackers gain access to accounts with administrative privileges. Proper security controls including phishing-resistant MFA, Conditional Access policies, Privileged Identity Management, and network segmentation significantly reduce compromise risk. Organizations should treat Intune admin accounts as Tier 0 assets requiring maximum protection.
Employees should understand that enrolling personal devices in company MDM systems like Intune grants the organization remote wipe capability. If this is unacceptable, use separate devices for work and personal use. Enable device encryption and maintain personal backups to cloud services the company cannot access. Ask IT about the organization's security controls protecting MDM administrative accounts.
References
[1] B. Krebs, "Medical Device Giant Stryker Hit by Destructive Cyberattack," Krebs on Security, Mar. 12, 2026. [Online]. Available: https://krebsonsecurity.com
[2] NBC News, "Stryker Corporation Cyberattack Disrupts Hospital Supply Chains Across 79 Countries," NBC News, Mar. 13, 2026. [Online]. Available: https://nbcnews.com
[3] Stryker Corporation, "Form 8-K Current Report: Cybersecurity Incident Disclosure," U.S. Securities and Exchange Commission, Mar. 11, 2026. [Online]. Available: https://sec.gov
[4] Check Point Research, "Handala Hack Team: Iran-Linked Threat Actor Profile," Check Point Research Blog, 2026. [Online]. Available: https://research.checkpoint.com
[5] Cyble Research and Intelligence Labs, "Void Manticore: Profiling Iran's Destructive Cyber Operations," Cyble, 2026. [Online]. Available: https://cyble.com
[6] Palo Alto Networks Unit 42, "Void Manticore Tactics, Techniques, and Procedures," Unit 42 Threat Intelligence, 2026. [Online]. Available: https://unit42.paloaltonetworks.com
[7] Microsoft, "Security Baseline for Microsoft Intune," Microsoft Learn, 2026. [Online]. Available: https://learn.microsoft.com/en-us/mem/intune/protect/security-baselines
[8] The Guardian, "Iran-Linked Hackers Claim Responsibility for Stryker Attack," The Guardian, Mar. 12, 2026. [Online]. Available: https://theguardian.com
[9] American Hospital Association, "Stryker Cyberattack: Supply Chain Impact Monitoring," AHA Advisory, Mar. 12, 2026. [Online]. Available: https://aha.org
[10] The Cyber Express, "Handala Cyberattack Forces Maryland EMS to Suspend EKG Transmission," The Cyber Express, Mar. 13, 2026. [Online]. Available: https://thecyberexpress.com
[11] R. Pilling, "Rhadamanthys and Custom Wipers: Handala's Phishing Arsenal," Sophos News, 2026. [Online]. Available: https://news.sophos.com
[12] TechCrunch, "Stryker Hack Highlights Vulnerabilities in Enterprise Device Management," TechCrunch, Mar. 11, 2026. [Online]. Available: https://techcrunch.com
[13] NIST, "Mobile Device Security: Cloud and Hybrid Builds," NIST Special Publication 1800-4, 2024. [Online]. Available: https://nist.gov/sp1800-4
[14] Microsoft, "Privileged Access Workstations Security Overview," Microsoft Security, 2025. [Online]. Available: https://learn.microsoft.com/en-us/security/privileged-access-workstations/overview
[15] CISA, "Cross-Sector Cybersecurity Performance Goals," Cybersecurity and Infrastructure Security Agency, 2025. [Online]. Available: https://cisa.gov/cpg
[16] Australian Cyber Security Centre, "Strategies to Mitigate Cyber Security Incidents," Essential Eight Maturity Model, 2025. [Online]. Available: https://cyber.gov.au/essential-eight
Worried about your organization's device management security? lil.business specializes in enterprise security architecture reviews, including MDM hardening, privileged access controls, and incident response planning. Get a free security consultation to understand your exposure and build resilience against destructive attacks.
Work With Us
Ready to strengthen your security posture?
lilMONSTER assesses your risks, builds the tools, and stays with you after the engagement ends. No clipboard-and-leave consulting.
Book a Free Consultation →TL;DR
- Hackers from Iran deleted everything on 200,000 Stryker company computers and phones on March 11, 2026
- They got into a special control panel that let them remote-delete any device the company managed
- Hospitals couldn't order medical equipment and ambulances couldn't send heart attack data to hospitals
- Even employees' personal phones got wiped if they had the company app installed
What Happened to Stryker?
On March 11, 2026, a group of hackers called Handala broke into Stryker Corporation's computer systems and deleted everything on over 200,000 devices in 79 different countries [1]. Imagine if someone could press a button and every computer, phone, and tablet at a huge company just went blank—that's exactly what happened [2].
Stryker makes medical equipment that hospitals use for surgeries, like robot arms that help doctors operate and machines that restart people's hearts [3]. When the hackers wiped all their computers, hospitals couldn't order new supplies, the factories couldn't make new equipment, and even the workers at Stryker couldn't do their jobs [1]. In Ireland, 5,000 people got sent home from work because nothing worked anymore [2].
The hackers didn't just break things randomly. They planned this attack for weeks or maybe months, quietly sneaking around Stryker's computers before finally pushing the delete button on everything at once [4].
How Did the Hackers Get In?
The hackers used something called Microsoft Intune, which is like a master remote control for all the computers and phones at a company [2]. Think of it like this: if your school had one special tablet that could control every student's iPad—lock them, delete apps, or even wipe them completely clean—that's what Microsoft Intune does for companies [5].
When hackers get into this master control panel, they have power over every single device [2]. That's what happened to Stryker. The hackers found a way to log into Stryker's control panel and then used it to delete everything on all 200,000 devices at the same time [1].
Before they deleted everything, the hackers changed Stryker's login page to show their logo—a drawing of a barefoot kid with a slingshot [6]. This was like leaving their signature so everyone would know who did it [4].
Why Did They Attack Stryker?
The hacker group Handala said they attacked Stryker because they were angry about something the United States military did [2]. On February 28, 2026, American missiles hit a school in Iran and killed over 175 people, mostly children [7]. The hackers said this attack was payback for those deaths [4].
But why Stryker specifically? Stryker sells medical equipment to the U.S. military (a $450 million contract signed in 2025) and also bought an Israeli company in 2019 [2]. The Handala hackers target companies they think are connected to America's military or to Israel [4]. According to cybersecurity experts, Handala works for Iran's government and has attacked many companies and government systems that have these kinds of connections [6].
This shows how cyberattacks aren't just about stealing money or information. Sometimes hackers attack to send a political message or get revenge for things happening in the real world [8].
What Happened to Hospitals?
When Stryker's systems went down, hospitals faced serious problems [1]. Almost every hospital in America that does surgery uses Stryker equipment—surgical tools, replacement joints for knees and hips, and communication systems that let doctors and nurses talk to each other [3].
With Stryker's ordering systems broken, hospitals couldn't get new supplies [1]. If a hospital ran out of a specific surgical tool, they couldn't just order more like usual [9].
The scariest problem happened in Maryland. Stryker makes a system called LifeNet that lets ambulances send heart attack patient data to hospitals while the ambulance is still driving [10]. Doctors at the hospital can see the patient's heart information and get ready before the ambulance arrives. When Stryker's systems crashed, hospitals had to turn off LifeNet connections because they weren't safe anymore [2]. This meant paramedics had to figure out if patients were having heart attacks by themselves, without hospital doctors helping [10].
What Happened to Stryker Employees?
Here's something really unfair: some Stryker employees who put the company app on their personal phones lost everything on those phones too [1]. Many companies let workers use their own phones for work email and company messages. To make this work, employees install a special app (called Company Portal or Intune) that gives the company some control over the phone [11].
When the hackers used Stryker's master control panel to delete everything, they didn't just wipe company computers. They also wiped every personal phone that had the company app installed [1]. Employees lost their personal photos, text messages, contacts, and even their phone service because the hackers deleted the digital SIM cards that make phones work [2].
This teaches an important lesson: when you put a work app on your personal phone, your company gets the power to delete everything on that phone, even your personal stuff [11]. If someone hacks your company, your personal device can get wiped too [1].
Who Are the Handala Hackers?
Handala is a hacker group that first appeared in December 2023 [4]. Cybersecurity researchers say they work for Iran's government, specifically a group called the Ministry of Intelligence and Security [6]. They're part of a bigger hacking operation called Void Manticore that focuses on attacking systems and embarrassing companies and governments [12].
The group is named after a cartoon character—a barefoot Palestinian kid holding a slingshot—created by an artist named Naji al-Ali in the 1960s [4]. The hackers use this character as their symbol in all their attacks [6].
Handala uses special attack software they built themselves. They have two main programs called "Hatef" and "Hamsa" that can delete data on computers running Windows or Linux [4]. According to security company Sophos, they also send fake emails that steal passwords and information before deleting everything [13].
One clever trick Handala uses: they route their attacks through Starlink satellite internet so it's harder for defenders to block them [12]. Since Starlink works from space and can have IP addresses from anywhere, it's tough to block "all Iran" when the hackers are using satellite connections [14].
How Can Companies Stay Safe?
Protecting against these kinds of attacks means putting multiple locks on the doors instead of just one [15]. Here's what companies should do:
Use stronger logins. Instead of just passwords, companies should require a special code from your phone or a physical security key to log into important systems [16]. This makes it much harder for hackers to get in even if they steal passwords [15].
Keep important systems separate. The control panel that can delete all devices should be on its own special network that's separated from regular company computers [16]. It's like keeping the fire alarm control box in a locked room instead of out in the hallway where anyone can reach it [17].
Have backups stored offline. Companies should save copies of important information on systems that aren't connected to the internet [15]. That way, if hackers delete everything on the main computers, the company can restore from the backup copies that the hackers couldn't reach [16].
Watch for suspicious activity. Security teams should set up alerts that trigger if someone tries to delete lots of devices at once or if an admin account logs in from a weird location [5]. Catching attacks early, before the hackers push the final delete button, can save everything [16].
What This Means for You
Even if you don't work for a big company, this attack teaches important lessons. If your job wants you to install a work app on your personal phone, understand that they're getting the power to delete everything on that phone [11]. You might want to use a separate work phone instead of risking your personal device [1].
For businesses, this attack shows that the systems you trust to manage all your devices can become weapons against you if hackers break in [2]. Protecting these master control systems should be a top priority [5].
And for everyone, this is a reminder that cyberattacks aren't just about criminals trying to steal credit cards. Sometimes hackers attack to send political messages or get revenge, and regular people and hospitals get caught in the middle [8].
FAQ
A wiper attack is when hackers use special software to permanently delete all the data on computers and phones. Unlike ransomware (where hackers lock your files and demand money to unlock them), wipers just destroy everything with no way to get it back. It's like the difference between a kidnapper and a burglar who burns down your house.
Over 200,000 devices got wiped on March 11, 2026. This included work computers, work phones, tablets, and even personal phones that had Stryker's work app installed. The attack hit 79 different countries where Stryker has offices and factories.
Political hackers like Handala attack companies they think are connected to countries they're in conflict with. Stryker sold medical equipment to the U.S. military and owned an Israeli company, which made them a target. It's like picking a fight with someone because you're mad at their friend—the company gets attacked because of political conflicts between governments.
If you installed a work or school app that required "device management" permission, yes they can. These apps give organizations remote control to delete everything on your device. Always ask what permissions you're giving before installing work apps on personal devices, and consider using a separate device for work if possible.
Back up your important photos and files to a cloud service that your work or school can't access (like personal Google Photos or iCloud). Use strong passwords and turn on two-factor authentication. If possible, keep work stuff on work devices and personal stuff on personal devices so they stay separated.
References
[1] B. Krebs, "Medical Device Giant Stryker Hit by Destructive Cyberattack," Krebs on Security, Mar. 12, 2026. [Online]. Available: https://krebsonsecurity.com
[2] NBC News, "Stryker Corporation Cyberattack Disrupts Hospital Supply Chains Across 79 Countries," NBC News, Mar. 13, 2026. [Online]. Available: https://nbcnews.com
[3] Stryker Corporation, "Form 8-K Current Report: Cybersecurity Incident Disclosure," U.S. Securities and Exchange Commission, Mar. 11, 2026. [Online]. Available: https://sec.gov
[4] Check Point Research, "Handala Hack Team: Iran-Linked Threat Actor Profile," Check Point Research Blog, 2026. [Online]. Available: https://research.checkpoint.com
[5] Microsoft, "Security Baseline for Microsoft Intune," Microsoft Learn, 2026. [Online]. Available: https://learn.microsoft.com/en-us/mem/intune/protect/security-baselines
[6] Cyble Research and Intelligence Labs, "Void Manticore: Profiling Iran's Destructive Cyber Operations," Cyble, 2026. [Online]. Available: https://cyble.com
[7] The Guardian, "Iran-Linked Hackers Claim Responsibility for Stryker Attack," The Guardian, Mar. 12, 2026. [Online]. Available: https://theguardian.com
[8] Palo Alto Networks Unit 42, "Void Manticore Tactics, Techniques, and Procedures," Unit 42 Threat Intelligence, 2026. [Online]. Available: https://unit42.paloaltonetworks.com
[9] American Hospital Association, "Stryker Cyberattack: Supply Chain Impact Monitoring," AHA Advisory, Mar. 12, 2026. [Online]. Available: https://aha.org
[10] The Cyber Express, "Handala Cyberattack Forces Maryland EMS to Suspend EKG Transmission," The Cyber Express, Mar. 13, 2026. [Online]. Available: https://thecyberexpress.com
[11] NIST, "Mobile Device Security: Cloud and Hybrid Builds," NIST Special Publication 1800-4, 2024. [Online]. Available: https://nist.gov/sp1800-4
[12] TechCrunch, "Stryker Hack Highlights Vulnerabilities in Enterprise Device Management," TechCrunch, Mar. 11, 2026. [Online]. Available: https://techcrunch.com
[13] R. Pilling, "Rhadamanthys and Custom Wipers: Handala's Phishing Arsenal," Sophos News, 2026. [Online]. Available: https://news.sophos.com
[14] Australian Cyber Security Centre, "Strategies to Mitigate Cyber Security Incidents," Essential Eight Maturity Model, 2025. [Online]. Available: https://cyber.gov.au/essential-eight
[15] CISA, "Cross-Sector Cybersecurity Performance Goals," Cybersecurity and Infrastructure Security Agency, 2025. [Online]. Available: https://cisa.gov/cpg
[16] Microsoft, "Privileged Access Workstations Security Overview," Microsoft Security, 2025. [Online]. Available: https://learn.microsoft.com/en-us/security/privileged-access-workstations/overview
[17] NIST, "Framework for Improving Critical Infrastructure Cybersecurity," NIST Cybersecurity Framework, 2024. [Online]. Available: https://nist.gov/cyberframework
Want to make sure your business is protected from attacks like this? lil.business helps companies build strong security that stops hackers before they can do damage. Talk to us about protecting your business—we explain everything in plain language, no tech jargon required.
