Stryker Global Networks Disrupted by Destructive Cyberattack Claimed by Handala
Learn More
Stryker, a leading U.S. medical technology corporation, reported a massive cyberattack on March 11, 2026, that triggered a global network disruption and forced the closure of its headquarters in Portage, Michigan.
The incident was publicly acknowledged by the company after employees were instructed to vacate facilities and disconnect all devices from corporate systems. The pro-Iran hacking group Handala claimed responsibility for the breach, asserting the attack was a retaliatory measure following military strikes in Iran.
Stryker has not confirmed the threat actor's identity but the hactivist group's logo reportedly appeared on internal login pages during the height of the disruption.
According to Portage Public Safety, the attackes wiped of data from mobile phones and computers connected to the company's infrastructure. Stryker officials stated that they found no evidence of traditional ransomware or malware, suggesting the use of destructive wiper techniques instead of financially motivated encryption scheme. The attackers likely exploited administrative access within the cloud-based management suite to push commands to endpoint devices, leading to the widespread loss of system functionality.
The compromised data and affected assets include:
- Data on wiped endpoint devices (laptops and desktop computers)
- Mobile device management (MDM) profiles and associated phone data
- Internal network communications and Microsoft environment configurations
- Proprietary system access credentials
The number of affected individuals is not disclosed. Stryker's shares fell by more than 3% immediately following reports of the incident.
Stryker immediately shuttered its 1941 facility in Portage and issued an emergency directive for all staff to remain off the network. The company specifically advised employees to remove the "Stryker Management profile" from their work phones to halt the automated wiping process. Stryker has engaged external security experts and notified relevant authorities to investigate the scope of the intrusion. The organization claims to have contained the situation and is currently utilizing business continuity measures to maintain support for its global partners and customers.
