Overview
- CISA issued guidance to harden endpoint management and highlighted Intune safeguards like least‑privilege roles, phishing‑resistant multifactor authentication, and multi‑admin approval for high‑impact actions.
- Stryker says the intrusion is contained and it is restoring Microsoft systems, but ordering, manufacturing and shipping remain disrupted and some patient‑specific procedures were rescheduled.
- Reporting points to a compromised Intune administrator account and creation of a new global admin used to mass‑wipe managed devices without deploying malware.
- Hudson Rock’s Alon Gal linked the breach to credentials harvested by infostealer malware, though Stryker has not detailed the initial access.
- The Iran‑linked group Handala claimed responsibility and boasted of large data theft and device wipes, claims that remain unverified as the FBI and Justice Department seized related websites.