cyber.hendryadrian.com
Cyber Attack & Data Breach · bleepingcomputer.com

Stryker Attack Wiped Nearly 80,000 Devices Through Intune, With No Malware Reported

· Original article ↗

Summary

A cyberattack on Stryker’s internal Microsoft environment remotely wiped nearly 80,000 devices via Intune after an administrator account was compromised. Handala claimed the attack; investigators found no evidence of data exfiltration, and ordering systems remained down

Key points

  • The attack was limited to Stryker’s internal Microsoft corporate environment; the company said its medical products remain safe to use.
  • A source familiar with the incident said an attacker compromised an administrator account, created a Global Administrator, and used Intune to wipe nearly 80,000 devices on March 11.
  • Handala claimed responsibility and alleged it wiped over 200,000 systems and stole 50 terabytes of data; investigators found no indication that data was exfiltrated.
  • Stryker said the incident was not a ransomware attack and that no malware was deployed.
  • Electronic ordering systems remained offline, so customers had to place orders through sales representatives while restoration efforts continued.
  • Microsoft DART and Palo Alto Unit 42 were investigating the incident.

Article Details

Victim Organization
Stryker
Incident Type
Cyberattack involving compromised administrator credentials, creation of a Global Administrator account, and remote wiping of employee devices through Intune.
Affected Records
Nearly 80,000 devices were reportedly wiped, according to a source familiar with the attack. Handala separately claimed it wiped over 200,000 systems, servers, and mobile devices; investigators found no indication of data exfiltration.
Affected Data Size
Handala alleged that 50 terabytes of data were stolen; investigators found no indication of exfiltration.
Operational Impact
Electronic ordering systems remained offline, requiring customers to place orders manually through sales representatives. Stryker was restoring supply-chain, transactional, shipping, and customer-order services. The company said its medical products were safe to use and unaffected.
Ransom Or Extortion
Stryker said the incident was not a ransomware attack, and no ransom demand was reported. Handala claimed responsibility and alleged data theft, but investigators found no indication of exfiltration.
Claim Status
confirmed

MITRE ATT&CK

T1098.003 · Additional Cloud RolesThe attacker reportedly created a Global Administrator account, granting it elevated privileges.T1136.003 · Cloud AccountThe attacker reportedly created a new Global Administrator account after compromising an administrator account.

Threat Actors

HandalaClaimed responsibility for the attack and alleged wiping over 200,000 systems, servers, and mobile devices and stealing 50 terabytes of data. Investigators found no indication of data exfiltration. The group was described as believed to be linked to Iran.

Vendors

MicrosoftStryker experienced a cyberattack limited to its internal Microsoft environment that remotely wiped tens of thousands of employee devices while the company confirms all medical products remain safe to use.Palo Alto NetworksMicrosoft DART and Palo Alto Unit 42 are investigating while Stryker focuses on restoring supply-chain and transactional services.

Products

IntuneHandala, who allegedly used compromised admin credentials to create a Global Administrator and issue an Intune wipe affecting ~80,000 devices, and investigators found no confirmed ransomware deployment or data

Countries

IranThe incident was claimed by Iran-linked hacktivist group Handala, who allegedly used compromised admin credentials to create a Global Administrator and issue an Intune wipe affecting ~80,000 devices, and investigators

Industries

medical technologyLast week’s cyberattack on medical technology giant Stryker was limited to its internal Microsoft environment and remotely wiped tens of thousands of employee devices.

Related Articles