Stryker Corporation — Iran-linked Handala Microsoft Intune wiper attack

On March 11, 2026, Stryker Corporation — one of the world's largest medical-device manufacturers (~$22B revenue, 79 countries, ~52,000 employees) — was hit by a wiper-class cyberattack that abused its Microsoft Intune cloud endpoint-management platform to issue enterprise-wide remote-wipe and OS-reset commands across workstations, servers, and mobile devices between 05:00 and 08:00 UTC. The attack required no malware deployment; attackers obtained Intune / Entra global-admin credentials and used native Microsoft management features to render the global Microsoft environment unusable, including defacing the company's Entra login page. The Iran-aligned hacktivist persona Handala — linked by Palo Alto Networks Unit 42 and Microsoft tracking to the Void Manticore cluster and ultimately to Iran's Ministry of Intelligence and Security (MOIS) — claimed responsibility on Telegram, framing the attack as retaliation tied to a February 28, 2026 missile strike on an Iranian school and citing Stryker's 2019 acquisition of Israeli orthopedic-implant maker OrthoSpace. Stryker disclosed the incident the same day via SEC Form 8-K and engaged Unit 42 for incident response. On April 9, 2026 the company filed a Form 8-K/A confirming full operational restoration and stating the incident had material impact on Q1 2026 earnings (specific figure to be quantified at the April 30 earnings call).

Global manufacturing network and order/shipping pipeline halted for approximately four weeks across 79 countries. Surgical-supply customers — including the UK National Health Service — experienced order delays affecting clinical operations; the LifeNet cardiac-EKG transmission service was temporarily disconnected by precautionary hospitals. Approximately 5,000 employees were sent home from the Cork, Ireland facility alone; some sites reverted to pen-and-paper workflows. Q1 2026 financial results were materially impacted per Stryker's 8-K/A; full-year 2026 guidance was reaffirmed as not materially impacted.