Iran-linked cyber attack targets US medtech giant Stryker

US medical equipment provider Stryker said its global networks were disrupted by a cyberattack on Wednesday, allegedly carried out by a hacking group linked to Iran. The attack impacted Stryker’s internal Microsoft environment and deleted information from devices, with one employee telling NBC News that company phones stopped working, grinding work and communications to a standstill.

In an SEC filing disclosing the attack, Stryker says the “full scope” of the operational and financial impact on its business “are not yet known,” and that it’s unable to provide a full restoration timeline. The situation was still ongoing as of 12:32AM ET on Thursday, when Stryker said that it was working to bring its systems back online as quickly as possible.

“We are continuing to resolve the disruption impacting our global network, resulting from the cyber attack,” Stryker said in the latest statement on its website. “At this time, there is no indication of malware or ransomware and we believe the situation is contained to our internal Microsoft environment only. Our products like Mako, Vocera and LIFEPAK35 are fully safe to use.”

An Iranian-linked hacker group called Handala has taken responsibility for the attack on X, claiming that it has extracted 50 terabytes of “critical data” from Stryker and wiped “over 200,000 systems, servers, and mobile devices.” Information from Reddit users linked to Stryker and The Wall Street Journal corroborates Handala’s involvement, reporting that the hacking group’s logo has appeared on Stryker employee login pages. Previous hacks that targeted US agencies and organizations have been attributed to Iran-linked groups before, but this marks the first significant cyberattack since war broke out between the two countries.

The attack is believed to have impacted all of Stryker’s operations in Europe, Asia, and the US. An employee at its base in Cork, Ireland — Stryker’s biggest site outside of the US — told the Irish Mirror that “nobody can work,” and that most of the company-assigned devices had been wiped.

“The entire company has been brought to a standstill. Nobody has any idea what is going on. This is going to have a huge knock-on effect.”