Stryker Fully Operational After Handala-Claimed Data-Wiping Attack
Summary
Stryker says global manufacturing is operational three weeks after a March 11 attack. Handala claimed stealing about 50 TB before nearly 80,000 devices were wiped; investigators found a concealment file, while CISA and Microsoft issued hardening guidance.
Key points
- Stryker says it is fully operational across its global manufacturing network, with production moving toward peak capacity.
- Handala claimed it stole about 50 terabytes of data before nearly 80,000 devices were wiped.
- The attackers reportedly compromised a Windows domain administrator account and created a new Global Administrator account.
- Investigators found a malicious file used to conceal activity inside Stryker’s network.
- CISA and Microsoft issued guidance on securing Intune and hardening Windows domains; the FBI seized two websites used by Handala.
Article Details
- Victim Organization
- Stryker Corporation
- Incident Type
- Cyberattack involving data wiping after attackers compromised a Windows domain administrator account and created a new Global Administrator account.
- Affected Records
- Nearly 80,000 devices were reportedly wiped; the number of affected records was not reported.
- Affected Data Size
- Handala claimed to have stolen approximately 50 terabytes of data; the theft was not independently confirmed in the article.
- Operational Impact
- Many systems were wiped, disrupting operations. Stryker restored critical systems and said it was fully operational across its global manufacturing network, with production moving toward peak capacity. The attack began on March 11, but the year is not stated.
- Ransom Or Extortion
- Handala claimed data theft; no ransom demand or specific extortion activity was reported.
- Claim Status
- confirmed
MITRE ATT&CK
Threat Actors
HamsaThe article identifies Hamsa as another name for Handala, which claimed the Stryker attack.HandalaThe article says the cyberattack was claimed by Handala, an Iranian-linked hacktivist operation. The group claimed to have stolen approximately 50 terabytes of data; the article does not independently confirm the theft.Handala Hack TeamThe article identifies Handala Hack Team as another name for Handala, which claimed the Stryker attack.HatefThe article identifies Hatef as another name for Handala, which claimed the Stryker attack.
Vendors
Products
IntuneCISA and Microsoft issued guidance to secure Intune and harden Windows domains, the FBI seized two Handala websites, investigators found a stealthy malicious file used to hide activity, and Stryker reports productionMicrosoft Windowsgroup that stole roughly 50 terabytes of data and wiped nearly 80,000 devices after compromising a Windows domain admin and creating a Global Administrator account.