Article
What happened
Stryker, the Michigan-based medical technology company, said on March 11 that a cyberattack caused a global disruption to its Microsoft environment. The company said it had seen no sign of ransomware or other malware, believed the incident was contained and was still assessing the impact. Employees were told not to log on to company computers or connect to its mobile apps.
Handala, a hacktivist group linked to Iran, claimed responsibility and described the attack as retaliation tied to the conflict with Iran. The group claimed it wiped more than 200,000 systems and took 50 terabytes of data. Those claims have not been verified, and Stryker has not said who was behind the incident. The federal Cybersecurity and Infrastructure Security Agency said it is working with partners and has opened an investigation.
Why it matters for hospitals
Stryker products, from implants and surgical equipment to beds and stretchers, are widely used in US hospitals. Even when clinical devices are unaffected, an outage in a supplier’s corporate systems can slow order processing, field service, instrument logistics and technical support. Most hospitals do not see that dependency until it breaks.
The incident also points to a shift in the threat picture. Researchers noted that, if the claims hold, this would be the group’s first disruptive strike on a major US enterprise. Geopolitically motivated attackers often aim for disruption rather than ransom, which means paying is not an exit and recovery can take longer.
Questions for leadership this week
- Which procedures depend on Stryker products, instruments or representatives, and what is on hand for the next two weeks?
- Do we have network connections, remote-access accounts or integrations with the vendor that should be reviewed or restricted?
- Does our downtime planning include a scenario in which a top supplier, rather than our own network, goes dark?
- Do our contracts spell out breach notification, service remedies and recovery expectations?
Supply chain and security teams should contact vendor account leaders directly rather than waiting for formal notices. Boards will want a short briefing on exposure and contingency plans before their next meeting.
Archive entry for Mar 11, 2026, added Nov. 11, 2026.