Stryker Tells SEC Recovery Timeline From Cyberattack Remains Unknown
Summary
Stryker told the SEC that recovery from a global cyber incident disrupting its Microsoft environment remains undated. About 5,500 employees were locked out; Handala claimed responsibility, while Intune abuse remains suspected.
Key points
- Stryker told the SEC that the incident disrupted its Microsoft environment and limited access to some information systems and business applications.
- About 5,500 employees across Ireland, the US, Australia and India were locked out of company systems.
- The company engaged external cybersecurity experts to assess and contain the threat; the timeline for full restoration is unknown.
- Employees reported that devices managed through Microsoft Intune had been wiped; experts said Intune abuse was a likely mechanism, not a confirmed finding.
- Stryker said the incident did not involve ransomware or malware, and its potential financial impact remains unclear.
- Handala claimed responsibility. Researchers cited overlaps with Iran-linked APT34, but the article does not establish attribution.
Article Details
- Victim Organization
- Stryker
- Incident Type
- Destructive cyberattack involving device wiping and disruption of company systems. Handala claimed responsibility, but its involvement in the incident was not independently confirmed.
- Operational Impact
- Devices were wiped, and about 5,500 employees across Ireland, the United States, Australia, and India were locked out of company systems. Stryker reported disruption to its Microsoft environment and limits on access to some information systems and business applications. The timeline for full restoration was unknown; financial impacts were unclear.
- Ransom Or Extortion
- Stryker said the incident did not involve ransomware. No ransom demand or extortion was reported.
- Claim Status
- confirmed
People
Threat Actors
HandalaClaimed responsibility for the Stryker attack; its involvement was not independently confirmed. Optiv said the group is known to deploy Hatef wiper malware and Rhadamanthys stealer malware in its attacks.SOLAR IONResearchers cited by the article reported significant overlap between Handala and APT34, an Iran-linked, state-backed group. The article does not establish APT34's responsibility for the Stryker incident.
Malware
Hatefgroup Handala claimed responsibility and pointed to abuse of Microsoft Intune tooling and references to Hatef and Rhadamanthys, with researchers noting overlaps between Handala and Iran-linked APT34.Rhadamanthysclaimed responsibility and pointed to abuse of Microsoft Intune tooling and references to Hatef and Rhadamanthys, with researchers noting overlaps between Handala and Iran-linked APT34.
Vendors
Products
Countries
Australiathat wiped employee devices and locked about 5,500 staff out of company systems across Ireland, the US, Australia and India, disrupting its Microsoft environment and prompting external cybersecurity teams to containIndiadevices and locked about 5,500 staff out of company systems across Ireland, the US, Australia and India, disrupting its Microsoft environment and prompting external cybersecurity teams to contain the threat.Irantooling and references to Hatef and Rhadamanthys, with researchers noting overlaps between Handala and Iran-linked APT34.Irelandcyber incident that wiped employee devices and locked about 5,500 staff out of company systems across Ireland, the US, Australia and India, disrupting its Microsoft environment and prompting external cybersecurityUnited StatesIt is one of the largest medical device makers in the U.S., reporting more than $25 billion in revenue last year.