Stryker Corporation filed Form 8-K/A on April 9, 2026, confirming that the March 11 wiper attack documented in the Stryker Handala Intune wiper incident record had a material impact on its Q1 2026 earnings, while reaffirming that full-year 2026 guidance (adjusted EPS of $14.90 to $15.10, organic sales growth of 8 to 9.5 percent) was unaffected. The filing also declared the company’s global manufacturing network and ordering and shipping pipeline fully restored. A specific dollar figure for the quarter is expected with the company’s earnings release on April 30, 2026.
The attack itself was a textbook abuse-of-feature operation. Between 05:00 and 08:00 UTC on March 11, the Iran-aligned hacktivist persona Handala used compromised Intune and Entra global-administrator credentials to issue enterprise-wide remote-wipe and OS-reset commands across Stryker’s 79-country footprint. No malware deployment was required. Login pages were defaced with the Handala logo, and Telegram messages framed the operation as retaliation for a February 28 missile strike in Iran and for Stryker’s 2019 acquisition of the Israeli orthopedic-implant maker OrthoSpace. Palo Alto Networks Unit 42, engaged for incident response, attributes the cluster to Void Manticore and ultimately to Iran’s Ministry of Intelligence and Security.
Operationally, the attack rhymes with the Norsk Hydro LockerGoga incident of 2019 and the IT-driven manufacturing fallout of NotPetya at Maersk in 2017. Stryker’s Cork, Ireland facility sent approximately 5,000 employees home; multiple sites reverted to pen-and-paper; the UK National Health Service reported delays to surgical-supply orders; and the LifeNet cardiac-EKG transmission service was temporarily disconnected by precautionary hospitals. Production-floor PLCs and HMIs were not directly compromised, but the loss of the company’s Microsoft environment was sufficient to halt output for roughly four weeks across 79 countries.
The forthcoming April 30 earnings call is the case’s regulatory inflection. A quantified material-impact figure on a global Tier-1 industrial manufacturer’s Q1 results will become the most direct financial benchmark to date for a cloud-MDM-driven OT-adjacent disruption, and a reference point for boards now treating Intune, Workspace ONE, and Jamf admin estates as Tier-0 controls. Defenders are already extracting the lesson Stryker is publicly absorbing: privileged cloud endpoint-management accounts must be treated as crown-jewel identity, with phishing-resistant MFA, conditional access, just-in-time elevation, and alerting on bulk-wipe or OS-reset operations.