Stryker Ordering Systems Remain Offline After Cyberattack; Medical Products Deemed Safe
Summary
Stryker says ordering, shipping, and support systems remain offline after a cyberattack reportedly wiped company devices through Microsoft Intune. The company says its connected medical products are safe; Handala claimed responsibility, but attribution is unconfirmed.
Key points
- Stryker’s electronic ordering, shipping, and customer-support systems remained offline about a week after the attack, with orders handled manually.
- The disruption caused factory closures and work interruptions at Stryker locations in multiple countries.
- Thousands of company devices were reportedly wiped using Microsoft Intune’s remote-wipe feature; Stryker said no ransomware or malware was involved.
- Stryker said the incident was contained to its internal Microsoft environment and its connected medical products were not affected and remain safe to use.
- Cisco Talos said hundreds of leaked Stryker credentials suggested high-level administrative account compromise.
- Handala claimed responsibility, citing Stryker’s work with the U.S. Defense Department; Stryker has not confirmed attribution to Iranian actors.
Article Details
- Victim Organization
- Stryker
- Incident Type
- Cyberattack involving reportedly compromised high-level administrative accounts and use of Microsoft Intune's remote-wipe feature to wipe company devices, causing widespread disruption.
- Data Types Exposed
- Administrative credentials; Cisco Talos reported identifying hundreds of leaked Stryker credentials on the dark web.
- Affected Records
- Cisco Talos reported identifying hundreds of leaked credentials; no affected-record count was reported.
- Affected Data Size
- Thousands of company devices were reportedly wiped. Data loss was described as possible, but no data-volume estimate was reported.
- Operational Impact
- Company-wide technology outages left electronic ordering, shipping, and customer-support systems offline for at least a week. Factory closures and work disruptions were reported at locations in multiple countries; orders were handled manually. Stryker said its connected medical products were not affected and remained safe to use.
- Ransom Or Extortion
- Stryker said no ransomware or malware was involved; no ransom demand was reported. Handala claimed responsibility, but Stryker had not confirmed attribution.
- Claim Status
- confirmed
MITRE ATT&CK
T1078 · Valid AccountsCisco Talos said the attack was almost certainly carried out by compromising high-level administrative accounts.T1485 · Data DestructionResponders said attackers likely used Microsoft Intune's native remote-wipe feature to reset corporate devices, causing widespread destruction and possible data loss.
Threat Actors
Vendors
Products
Care.ai sensor systemThis includes the Vocera Voice hands-free, voice-controlled communication system and the Care.ai sensor system used in hospital rooms.Microsoft Intuneoffline a week after a cyberattack that reportedly wiped thousands of company devices by abusing Microsoft Intune’s remote-wipe capability, forcing manual order processing and causing factory closures.Vocera VoiceThis includes the Vocera Voice hands-free, voice-controlled communication system and the Care.ai sensor system used in hospital rooms.