Stryker's Devices Wiped Through Its Own Management Console, in an Iran-Linked Attack
The Handala group reportedly abused Microsoft Intune's remote-wipe feature, erasing tens of thousands of devices at the medtech giant without classic malware.
Key takeaways
- Handala claimed 200,000+ systems wiped; independent outlets cite far lower figures such as 80,000 devices.
- Investigators believe attackers used Intune's legitimate remote-wipe command, so no custom wiper was needed.
- Employees' personal phones enrolled for work email were also affected; Stryker said its medical products were not.
On 11 March 2026, the medical-technology maker Stryker lost control of a large share of its device fleet in minutes. The pro-Iran hacktivist group Handala claimed responsibility, and early investigation points to an unsettling method: rather than deploying a custom wiper, the attackers appear to have used Microsoft Intune, the company's own endpoint-management service, to tell devices to erase themselves.
What happened
Stryker confirmed the incident in a securities filing and said the disruption was confined to its internal Microsoft environment, adding that its medical products were not affected. Operations were disrupted for several days, and the hit later showed up in first-quarter results, according to TechCrunch's year-to-date roundup of 2026 attacks. The US government has linked Handala to Iranian intelligence, though Stryker itself has not confirmed attribution.
Scale is contested. Handala claimed more than 200,000 systems, servers and mobile devices were wiped and 50 terabytes of data stolen. Other outlets are more conservative: TechRadar's reporting cites roughly 80,000 devices, and other coverage speaks of tens of thousands. The data-theft claim has not been independently confirmed. As with most hacktivist announcements, the numbers should be treated as marketing until corroborated.
Why no malware was needed
Intune and similar mobile-device-management tools exist so administrators can lock or wipe a lost laptop or phone. That is a feature, and it works at scale: a single privileged account can send the command to every enrolled device. A source told KrebsOnSecurity that the perpetrators appear to have used Intune to issue a remote wipe against all connected devices. If so, the intrusion was less about technical exploitation of endpoints than about capturing a powerful administrative identity.
Defenders call this living off the land: using trusted tools so security software sees nothing unusual. Endpoint detection looks for malicious files, but a signed management command from the cloud console is not a malicious file. Enrolment also follows the account rather than the hardware. Employees who had added work email to personal phones found those phones wiped as well, which turned a corporate outage into a personal one.
Why it matters
The Stryker case is a case study in destructive, politically motivated intrusion against a Western healthcare supplier. Healthcare firms have been told for years to worry about ransomware, where attackers want payment and have a reason to leave systems recoverable. Wiper-style attacks have no such incentive, and Handala sits in a lineage of Iran-aligned groups that mix claims of data theft with disruption. The same TechCrunch roundup lists other 2026 incidents involving Iranian actors, including opportunistic attacks on more than 100 US water providers confirmed by CISA, a reminder that poorly defended operators are targets of convenience.
A trusted source told KrebsOnSecurity the perpetrators appear to have used Intune to issue a remote wipe to all connected devices.
The lesson reaches well beyond one vendor. Any organisation that centralises device control in a cloud console has also centralised the blast radius. Controls now widely recommended include requiring phishing-resistant multi-factor authentication for every administrator, using separate dedicated admin accounts, limiting which roles may issue wipe actions, and requiring a second approver for bulk device operations. Microsoft has features aimed at this kind of multi-admin approval, and the incident will likely push customers to enable them.
Recovery is the other hard part. A wiped laptop must be re-imaged and re-enrolled, and if the enrolment service itself is under suspicion, rebuilding trust takes time. Companies should keep offline copies of critical data, maintain an emergency path for provisioning devices that does not depend on the compromised console, and rehearse communicating with staff whose phones and laptops have gone blank.
What to watch
- Stryker's detailed findings: how the admin access was obtained, and whether any data theft is confirmed.
- Guidance from Microsoft and CISA on protecting device-management consoles and approving bulk actions.
- Further Handala operations against Western healthcare and industrial firms, and whether attribution to Iranian intelligence leads to sanctions or indictments.
- Recovery lessons: how fast a company can re-enrol and re-image a fleet when its management plane is itself the casualty.
Sources
- Stryker hackers allegedly wiped tens of thousands of devices without using any malware — TechRadar
- Medtech giant Stryker offline after Iran-linked wiper malware attack — BleepingComputer
- Exposure Brief: Iranian-Linked Wiper Attack on Global Medtech Firm Stryker — Censys
- Leaks, data breaches, and ransom notes: The worst hacks of 2026 so far — TechCrunch
