Stryker Reports Global Disruption After Handala Claims Wiper Attack
Summary
Stryker reported a severe global disruption affecting laptops and network-connected systems. Employees said devices were remotely wiped; Handala claims it stole 50 terabytes of data and wiped over 200,000 systems. Stryker is working with Microsoft to restore systems.
Key points
- Stryker told employees it was experiencing a severe global disruption affecting laptops and systems connected to its network; it said the root cause had not yet been identified.
- Employees in several countries reported that managed Windows and mobile devices were remotely wiped, including some personal phones enrolled for work access.
- Handala claimed it stole 50 terabytes of data and wiped more than 200,000 systems, servers, and mobile devices; these claims are not independently confirmed in the article.
- Employees reported disruptions to internal services and applications, with some locations reverting to paper-based workflows.
- The company said it was working with Microsoft to restore systems and treating the incident as a critical enterprise-wide disruption.
- The article reports that Stryker’s Entra login page was defaced to display a Handala logo.
Article Details
- Victim Organization
- Stryker
- Incident Type
- Wiper malware attack, claimed by Handala; employees also reported remote device wipes, defacement of Stryker’s Entra login page, and widespread service outages.
- Data Types Exposed
- Sensitive/critical data (theft claimed; specific data types not disclosed)
- Affected Data Size
- 50 terabytes reportedly stolen, according to Handala; the claim is unverified.
- Operational Impact
- Stryker reported a severe global disruption affecting laptops and systems connected to its network. Employees reported remote wipes of managed and personal devices enrolled for work access, and some locations reportedly switched to paper workflows. Handala claimed that offices in 79 countries were forced to shut down. Stryker said it was working with Microsoft to restore systems.
- Claim Status
- claimed
Threat Actors
HamsaThe source identifies Hamsa as another name for Handala, which claimed the Stryker attack; the group’s specific claims are unverified in the article.HandalaThe source identifies Handala as the group claiming responsibility for the attack on Stryker and claiming theft of 50 terabytes of data and wiping of over 200,000 systems and devices. The claims are not independently confirmed in the article.Handala Hack TeamThe source identifies Handala Hack Team as another name for Handala, which claimed the Stryker attack; the group’s specific claims are unverified in the article.HatefThe source identifies Hatef as another name for Handala, which claimed the Stryker attack; the group’s specific claims are unverified in the article.
Vendors
Products
EntraEmployees across multiple countries reported remote wiping of managed and personal devices, defacement of Stryker’s Entra login page, and widespread outages as the company works with Microsoft to restore systems.Intune Company PortalStaff were instructed to remove corporate management and applications from their personal devices, including the Intune Company Portal, Teams, and VPN clients.
Countries
Australiareports from people claiming to be Stryker employees from the United States, Ireland, Costa Rica, and Australia, who said their managed Windows and mobile devices were remotely wiped in the middle of the night.Costa RicaThis aligns with reports from people claiming to be Stryker employees from the United States, Ireland, Costa Rica, and Australia, who said their managed Windows and mobile devices were remotely wiped in the middle ofIrelandThis aligns with reports from people claiming to be Stryker employees from the United States, Ireland, Costa Rica, and Australia, who said their managed Windows and mobile devices were remotely wiped in the middle ofUnited StatesThis aligns with reports from people claiming to be Stryker employees from the United States, Ireland, Costa Rica, and Australia, who said their managed Windows and mobile devices were remotely wiped in the middle of