Stryker said a cyberattack on March 11 caused a global disruption to its Microsoft environment, affecting order processing, manufacturing and shipping [1]. According to BleepingComputer, Iran-linked Handala claimed the attack and said it wiped over 200,000 systems and devices and stole 50 TB of data; Stryker later said the attacker used a malicious file to run commands and hide activity, with no malicious activity found against customers or suppliers [2][1]. Stryker said its products, including connected products, were not affected and remain safe to use; hospitals affected by personalized-implant shipping delays should confirm rescheduling with Stryker [1].
Backfill: this event became public on Mar 11, 2026 and we added it on Nov 11, 2026. It is not a new event.
CriticalResolvedBackfillOfficially confirmed
Medtech maker Stryker's internal Microsoft environment hit by global outage; Iran-linked hackers claim mass device wipe
1 min read
- Disclosed
- Mar 11, 2026
- Occurred
- Mar 11, 2026
- Published
- Nov 11, 2026
- Last updated
- Nov 11, 2026
- CVSS basis
- Our assessment
StrykerPalo Alto Networks Unit 42IdentityEndpointHealthcareManufacturingUnited StatesSystem intrusion
- Technology
- Productivity suiteWindows
- Attack vector
- Unknown
- Impact
- Service disruption
- Actor type
- Hacktivist
- Motivation
- Unknown
On this page
30-second summary
Timeline
Technical details
Remediation
Vendor guidance
- 1Confirm orders and case schedules verify[1]
Hospitals using personalized implants should confirm orders and rescheduling with Stryker.
References
Official / primary1
- [1]Stryker2026-03-12Accessed 2026-11-11Snapshot 2026-11-11 sha256 9364af6af343
“This incident has caused disruptions to order processing, manufacturing and shipping. However, we are working diligently to restore our systems and above all, we are committed to ensuring our customers can continue to deliver seamless patient care.”
Media1
- [2]BleepingComputer2026-03-11Accessed 2026-11-11Snapshot 2026-11-11 sha256 9f087034b078
“Leading medical technology company Stryker has been hit by a wiper malware attack claimed by Handala, an Iranian-linked and pro-Palestinian hacktivist group.”
Expert help
Still not sure whether this affects you?
Tell us about your environment. We'll check it against this advisory, assess the risk, and give you concrete patch and monitoring steps.
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.