TLDR Tech / InfoSec
Stryker Targeted by Large-Scale Wiper Attack, Tens of Thousands of Devices Lost
The pro-Iranian hacktivist group Handala compromised Stryker's Microsoft Intune environment on March 11, abusing legitimate MDM remote-wipe functionality to factory reset tens of thousands of Windows endpoints across 79 countries, erasing up to 95% of devices in some offices before containment. Handala, assessed by Palo Alto Networks to operate under the Iranian Ministry of Intelligence and Security, claims to have wiped over 200,000 systems and exfiltrated 50 TB of corporate data prior to triggering the destructive wipe. Medical devices, Vocera, Mako surgical robotics, LIFEPAK, and SurgiCount platforms remained unaffected due to architectural isolation from the impacted Microsoft environment. Organizations should audit MDM admin credential access and enforce conditional access policies to prevent similar living-off-the-land abuse.
Read the full story