Quick answer: In March 2026, a pro-Iran hacktivist group called Handala broke into Stryker, one of the world’s largest medical technology companies, and remotely wiped tens of thousands of employee devices. The attack disrupted operations for several days and had a material impact on Stryker’s first-quarter earnings. It was a destructive attack designed to cause damage, not a typical data theft.
| Key facts | |
|---|---|
| Date | March 2026 |
| Organization | Stryker (medical technology, United States) |
| Type of attack | Wiper (destructive) attack |
| Attacker | Handala, a pro-Iran hacktivist group the US government linked to Iranian intelligence |
| Impact | Tens of thousands of employee devices wiped; operations disrupted for several days; material impact on quarterly earnings |
| Root cause (lesson) | Attackers able to reach systems that could wipe devices at scale |
Timeline
- March 2026: Attackers gain access to Stryker’s environment and remotely wipe tens of thousands of employee devices.
- Following days: Operations are disrupted for several days while systems and devices are restored.
- Q1 2026 results: Stryker reports that the incident had a material impact on its first-quarter earnings.
What happened
Stryker makes surgical equipment, implants and hospital technology used around the world. In March 2026, attackers from a group calling itself Handala got inside its network and used that access to remotely erase tens of thousands of laptops and other employee devices. Unlike ransomware, a wiper attack does not offer a way to get data back for a payment. Its goal is disruption.
The US government linked Handala to Iranian intelligence. The attack came during a period of heightened conflict involving Iran, when Iran-linked groups were also targeting US water systems and other infrastructure.
How the attackers got in
Stryker has not published a full technical account. What is clear is that the attackers reached systems with enough control to wipe devices at scale. In modern companies, that kind of power usually sits in device management platforms, identity systems and administrator accounts. Whoever controls those can push a command to every enrolled laptop at once.
The impact
Wiping tens of thousands of devices meant employees could not work normally until machines were rebuilt or replaced. Operations were disrupted for several days, and Stryker said the incident had a material financial impact on its first-quarter earnings. For a medical technology supplier, disruption also risks delays for hospitals that depend on its products and support.
Lessons for your organization
- Protect device management and admin consoles with phishing-resistant MFA, such as passkeys or security keys.
- Require approval from a second administrator before mass actions like wiping or resetting devices.
- Keep offline, immutable backups and a tested plan to rebuild laptops and servers quickly.
- Monitor for unusual admin activity, such as a sudden burst of wipe or delete commands.
- Include destructive attacks, not only ransomware, in incident response exercises.
This incident is part of our guide to major cyber attacks and data breaches, which compares the biggest incidents and the patterns behind them. Read more about incident response strategies. To see whether the same weaknesses exist in your organization, take the free Cybersecurity Readiness Assessment.
Frequently asked questions
Who attacked Stryker?
A pro-Iran hacktivist group called Handala, which the US government linked to Iranian intelligence.
What is a wiper attack?
A wiper attack permanently deletes data or makes devices unusable. Unlike ransomware, there is usually no way to recover data by paying.
How did the Stryker attack affect the business?
Tens of thousands of employee devices were wiped, operations were disrupted for several days and the company reported a material impact on first-quarter earnings.
