Stryker Says Malware Was Used in Cyberattack as Production Lines Reopen
Summary
Stryker is restoring production after attackers allegedly used Microsoft Intune to wipe more than 200,000 employee devices. Unit 42 says persistence was removed; a DOJ affidavit describes disrupted hospital communications and emergency care in Maryland.
Key points
- Attackers allegedly used Microsoft Intune’s device-wipe feature to erase data on more than 200,000 Stryker employee devices across multiple countries.
- Stryker is rebuilding affected systems or restoring pre-compromise backups, isolating systems not yet restored and prioritizing customer-facing operations.
- A DOJ affidavit says the disruption led some Maryland hospitals to suspend connections; clinicians relied on radio and verbal communication, and Bloomberg reported some surgeries were canceled over implant shortages.
- Stryker’s latest update said a malicious file was used to run commands and hide attacker activity; the company said the file could not spread. Stryker had previously said no malware was involved.
- Palo Alto Networks Unit 42 helped remove unauthorized persistence mechanisms and reported no current evidence of active, uncontained persistent access or access to customer, supplier, vendor or partner systems.
- Stryker says its customer technology is safe to use and was not connected to the attack, which targeted internal corporate systems.
Article Details
- Victim Organization
- Stryker
- Incident Type
- Cyberattack involving the alleged use of Microsoft Intune’s device-wipe feature to erase company data from employee devices.
- Operational Impact
- More than 200,000 employee devices were reportedly wiped, prompting system rebuilds or restoration from backups and isolation of systems not yet restored. Stryker said it was prioritizing customer-facing, ordering, and shipping systems as manufacturing resumed. A Justice Department affidavit said the disruption affected emergency medical services in Maryland and prompted some hospitals to suspend connections; Bloomberg reported that some surgeries were canceled because Stryker-made implants were unavailable. Unit 42 reported no current evidence of active, uncontained unauthorized access to Stryker systems or access to customer, supplier, vendor, or partner systems.
- Ransom Or Extortion
- Stryker said no ransomware was involved. No extortion activity was reported.
- Claim Status
- confirmed
People
Vendors
MicrosoftStryker is ramping production two weeks after alleged Iranian cyber actors used Microsoft Intune’s device-wipe feature to destroy data on more than 200,000 employee devices, prompting system rebuilds and isolation ofPalo Alto NetworksPalo Alto Networks Unit 42 confirmed the attackers were removed, found no evidence of active unauthorized access to customer systems, and Stryker is prioritizing restoration of customer-facing operations.
Products
Countries
Indiaall company data on more than 200,000 devices across Stryker’s employee base in the U.S., Ireland, India and other countries.Ireland— to destroy all company data on more than 200,000 devices across Stryker’s employee base in the U.S., Ireland, India and other countries.United Statesfeature — to destroy all company data on more than 200,000 devices across Stryker’s employee base in the U.S., Ireland, India and other countries.