Iranian Hackers Used Stolen Credentials to Breach Medical Giant Stryker

Iran-linked hackers breach Stryker, wiping 200,000 devices globally. FBI investigates this major US cyberattack by Handala group.

By Content Team

Mar 18, 2026

ON THIS PAGE

Iran-linked hacker group Handala compromised US medical technology company Stryker on March 11, wiping over 200,000 devices and forcing office shutdowns across dozens of countries. New evidence reveals the attackers likely used credentials stolen by infostealer malware, some potentially years old, to access Stryker's Microsoft Intune system.

The hackers created a global admin account through the compromised Intune administrator credentials, then remotely wiped managed devices. Stryker manufactures surgical equipment and orthopedic implants for hospitals worldwide. The breach disrupted order processing, manufacturing, and shipping, though the company says all products remain safe to use.

CISA and FBI are investigating the incident, marking the most significant Iranian cyberattack against the US since the Gaza conflict began.

Source: Security Week

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?