{"id":"stryker-device-wipe-disrupts-supplies-mar-2026","category":"breach","status":"closed","title":"Stryker device-wiping attack disrupts medical supplies and delays implant procedures","tldr":"A destructive attack on Stryker disrupted medical supplies and delayed some implant procedures. Manufacturing and ordering systems were restored by April. Stryker said its medical devices were unaffected; ask your care team about any delayed procedure.","summary":"The 11 March attack disrupted Stryker's corporate network and medical-supply operations. BleepingComputer reported that nearly 80,000 employee devices were remotely erased through Microsoft's Intune management service, citing a source familiar with the investigation. The Iran-linked group Handala claimed responsibility and alleged substantial data theft; those theft claims remain unverified in the sources reviewed. Shipping delays caused some procedures involving patient-specific implants to be postponed. Stryker said its medical products remained safe to use. Investigators later identified a malicious file, revising the company's initial assessment that no malware was involved. Unit 42 reported containment, and Stryker announced restored manufacturing, ordering and distribution systems on 1 April. Its May filing confirmed a material first-quarter operational and financial impact and an ongoing investigation. As at 3 November, the reviewed sources do not establish a final data-exposure finding or total incident cost.","action":"There is no family-device update to install for this incident. If your procedure was delayed or depends on a Stryker patient-specific implant, ask your surgeon or hospital to confirm availability and scheduling; Stryker said its medical products were unaffected.","product":"Stryker corporate IT and medical-supply operations","audience":"both","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["stryker","healthcare","cyberattack","device-wipe","medical-devices","service-disruption"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"Customer Updates: Stryker Network Disruption","url":"https://www.stryker.com/us/en/about/news/2026/a-message-to-our-customers-03-2026.html","by":"Stryker","date":"2026-04-01"},{"kind":"advisory","title":"A Message To Our Customers","url":"https://www.stryker.com/eg/en/about/news/a-message-to-our-customers-03-2026.html","by":"Stryker","date":"2026-03-23"},{"kind":"advisory","title":"Form 8-K: incident update and Unit 42 assurance letter","url":"https://d18rn0p25nwr6d.cloudfront.net/CIK-0000310764/42efb4ff-6468-466c-ad5e-0fdbcb968dba.pdf","by":"Stryker","date":"2026-03-23"},{"kind":"advisory","title":"2026 First Quarter Form 10-Q","url":"https://www.sec.gov/Archives/edgar/data/310764/000031076426000031/syk-20260331.htm","by":"Stryker","date":"2026-05-11"},{"kind":"news","title":"Stryker attack wiped tens of thousands of devices, no malware needed","url":"https://www.bleepingcomputer.com/news/security/stryker-attack-wiped-tens-of-thousands-of-devices-no-malware-needed/amp/","by":"BleepingComputer","date":"2026-03-16"},{"kind":"news","title":"Stryker confirms cyberattack is contained and restoration underway","url":"https://www.cybersecuritydive.com/news/stryker-confirms-cyberattack-is-contained-and-restoration-underway/815427/","by":"Cybersecurity Dive","date":"2026-03-23"},{"kind":"news","title":"Pro-Iran Hacktivist Group Claims Responsibility for Stryker Cyberattack","url":"https://www.itechguides.com/pro-iran-hacktivist-group-claims-responsibility-for-stryker-cyberattack/","by":"iTechGuides","date":"2026-08-12"}],"started":"2026-03-11","closed":"2026-05-11","created":"2026-11-03T20:48:44.340Z","updated":"2026-11-03T20:48:44.340Z","cve_notes":[],"timeline":[{"at":"2026-05-11","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"Stryker's first-quarter filing confirmed recovery of manufacturing and commercial systems but said the attack materially affected operations and first-quarter financial results. Its investigation remained ongoing, with possible further consequences.","url":"https://www.sec.gov/Archives/edgar/data/310764/000031076426000031/syk-20260331.htm","by":"Stryker","patch":null},{"at":"2026-04-01T14:45Z","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"Stryker reported its global manufacturing network fully operational, supported by restored commercial, ordering and distribution systems. Production was still moving towards peak capacity.","url":"https://www.stryker.com/us/en/about/news/2026/a-message-to-our-customers-03-2026.html","by":"Stryker","patch":null},{"at":"2026-03-23","added":"2026-11-03T20:32:12.437Z","kind":"vendor-revised","text":"Stryker revised its early account: investigators found a malicious file used to conceal activity, although it could not spread. Its SEC update also clarified that the disrupted corporate network extended beyond the Microsoft environment.","url":"https://d18rn0p25nwr6d.cloudfront.net/CIK-0000310764/42efb4ff-6468-466c-ad5e-0fdbcb968dba.pdf","by":"Stryker","patch":null},{"at":"2026-03-20T15:20Z","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"Unit 42 reported no evidence of continuing, uncontained unauthorised access within its investigation's scope. Stryker was rebuilding or restoring affected systems, with systems awaiting recovery isolated from the network.","url":"https://d18rn0p25nwr6d.cloudfront.net/CIK-0000310764/42efb4ff-6468-466c-ad5e-0fdbcb968dba.pdf","by":"Stryker / Palo Alto Networks Unit 42","patch":null},{"at":"2026-03-19","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"Stryker acknowledged that shipping delays had forced some procedures using patient-specific implants scheduled for the week of 16 March to be rescheduled.","url":"https://www.stryker.com/eg/en/about/news/a-message-to-our-customers-03-2026.html","by":"Stryker","patch":null},{"at":"2026-03-16","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"BleepingComputer reported, citing a source familiar with the attack, that nearly 80,000 devices were remotely erased on 11 March through Microsoft's Intune device-management service. Some employees also lost personal data on enrolled personal devices.","url":"https://www.bleepingcomputer.com/news/security/stryker-attack-wiped-tens-of-thousands-of-devices-no-malware-needed/amp/","by":"BleepingComputer","patch":null},{"at":"2026-03-12","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"Stryker confirmed disruption to order processing, manufacturing and shipping. It said its connected medical products were unaffected and safe to use.","url":"https://www.stryker.com/eg/en/about/news/a-message-to-our-customers-03-2026.html","by":"Stryker","patch":null},{"at":"2026-03-11","added":"2026-11-03T20:32:12.437Z","kind":"disclosed","text":"Stryker disclosed a cyberattack disrupting its global Microsoft environment. It activated business continuity measures and began investigating.","url":"https://www.stryker.com/eg/en/about/news/a-message-to-our-customers-03-2026.html","by":"Stryker","patch":"na"}],"url":"https://hard.fyi/live/stryker-device-wipe-disrupts-supplies-mar-2026/","json":"https://hard.fyi/api/live?id=stryker-device-wipe-disrupts-supplies-mar-2026"}