Overview
- U.S. cyber authorities issued an alert instructing organizations to tighten Intune and similar endpoint management setups, emphasizing least‑privilege roles, phishing‑resistant MFA, and multi‑admin approval for high‑impact actions such as device wipes.
- Investigators and reporting indicate the intruders misused Stryker’s Intune console after compromising administrator access, with new research suggesting the credentials were likely harvested from infostealer malware logs.
- Stryker says the incident is contained and restoration is underway, noting the impact was limited to its Microsoft environment while ordering and shipping remain disrupted and products continue to be safe to use.
- The Handala hacktivist persona, linked by analysts to Iran’s intelligence apparatus, claimed responsibility for the intrusion and large‑scale data theft, though key elements of those claims have not been independently verified.
- The FBI and CISA are engaged with the company as part of the investigation, and security firms warn the operation reflects a broader surge in Iran‑aligned disruptive activity targeting private‑sector networks.