Overview
- CISA issued an alert pointing to the Stryker incident and urged organizations to harden endpoint management, including least‑privilege RBAC, phishing‑resistant MFA, and multi‑admin approval for device wipes and other high‑impact actions.
- Reports indicate the intruders abused Stryker’s Intune console to send mass wipe commands after compromising an administrator account and creating a new Global Admin, with researchers finding infostealer logs containing Stryker admin credentials.
- Stryker says the attack is contained with no indication of ransomware or deployed malware, its products remain safe to use, and restoration of affected systems is ongoing.
- Disruptions to ordering, manufacturing, and shipping have limited delivery of personalized inventory, leading some providers to reschedule patient‑specific surgical cases and to temporarily restrict connectivity to Stryker systems.
- Federal involvement includes coordination by CISA and the FBI, with the FBI and DOJ seizing websites tied to Handala, which claimed responsibility as Iran‑linked; assertions about the number of wiped devices and data theft remain unverified.