Stryker device-wiping attack disrupts medical supplies and delays implant procedures
A destructive attack on Stryker disrupted medical supplies and delayed some implant procedures. Manufacturing and ordering systems were restored by April. Stryker said its medical devices were unaffected; ask your care team about any delayed procedure.
There is no family-device update to install for this incident. If your procedure was delayed or depends on a Stryker patient-specific implant, ask your surgeon or hospital to confirm availability and scheduling; Stryker said its medical products were unaffected.
What’s happening
The 11 March attack disrupted Stryker's corporate network and medical-supply operations. BleepingComputer reported that nearly 80,000 employee devices were remotely erased through Microsoft's Intune management service, citing a source familiar with the investigation. The Iran-linked group Handala claimed responsibility and alleged substantial data theft; those theft claims remain unverified in the sources reviewed. Shipping delays caused some procedures involving patient-specific implants to be postponed. Stryker said its medical products remained safe to use. Investigators later identified a malicious file, revising the company's initial assessment that no malware was involved. Unit 42 reported containment, and Stryker announced restored manufacturing, ordering and distribution systems on 1 April. Its May filing confirmed a material first-quarter operational and financial impact and an ongoing investigation. As at 3 November, the reviewed sources do not establish a final data-exposure finding or total incident cost.
- What
- Breach
- Affects
- Stryker corporate IT and medical-supply operations
- Fixed in
- Nothing to patch
- Since
- 11 Mar 2026
- Closed
- 11 May 2026
Timeline
- Update
Stryker's first-quarter filing confirmed recovery of manufacturing and commercial systems but said the attack materially affected operations and first-quarter financial results. Its investigation remained ongoing, with possible further consequences.
- Update
Stryker reported its global manufacturing network fully operational, supported by restored commercial, ordering and distribution systems. Production was still moving towards peak capacity.
- Vendor revised
Stryker revised its early account: investigators found a malicious file used to conceal activity, although it could not spread. Its SEC update also clarified that the disrupted corporate network extended beyond the Microsoft environment.
- Update
Unit 42 reported no evidence of continuing, uncontained unauthorised access within its investigation's scope. Stryker was rebuilding or restoring affected systems, with systems awaiting recovery isolated from the network.
- Update
Stryker acknowledged that shipping delays had forced some procedures using patient-specific implants scheduled for the week of 16 March to be rescheduled.
- Update
BleepingComputer reported, citing a source familiar with the attack, that nearly 80,000 devices were remotely erased on 11 March through Microsoft's Intune device-management service. Some employees also lost personal data on enrolled personal devices.
- Update
Stryker confirmed disruption to order processing, manufacturing and shipping. It said its connected medical products were unaffected and safe to use.
- Made publicNothing to patch
Stryker disclosed a cyberattack disrupting its global Microsoft environment. It activated business continuity measures and began investigating.
Sources
- Customer Updates: Stryker Network DisruptionStryker · 1 Apr 2026
- A Message To Our CustomersStryker · 23 Mar 2026
- Form 8-K: incident update and Unit 42 assurance letterStryker · 23 Mar 2026
- 2026 First Quarter Form 10-QStryker · 11 May 2026
- Stryker attack wiped tens of thousands of devices, no malware neededBleepingComputer · 16 Mar 2026
- Stryker confirms cyberattack is contained and restoration underwayCybersecurity Dive · 23 Mar 2026
- Pro-Iran Hacktivist Group Claims Responsibility for Stryker CyberattackiTechGuides · 12 Aug 2026