Stryker, a prominent global medical technology provider, reports a full recovery three weeks following a cyberattack by the Handala group, alleged to have ties to Iran, which compromised numerous systems.

The Fortune 500 medical device manufacturer, boasting over 53,000 employees, a diverse product range (including neurotechnology and surgical solutions), and $22.6 billion in global sales in 2024, was targeted in the incident.

The cyberattackers reportedly initiated the system wipe on March 11, claiming to have exfiltrated 50 terabytes of data before wiping around 80,000 devices in a morning attack, utilizing a newly created Global Administrator account after breaching a Windows domain admin account.

Following the disclosure of the attack, CISA and Microsoft issued guidance for enhanced protection of Intune and Windows domains to prevent similar incidents, while the FBI shut down two websites associated with the Handala hackers.

On Wednesday, Stryker announced the restoration of its systems sufficiently to resume pre-attack operational levels, with production quickly returning to full capacity.

“As of this week, our global manufacturing network is fully operational. Production is swiftly advancing towards maximum capacity with control and stability, facilitated by restored commercial, ordering, and distribution systems,” Stryker stated.

“Overall, product supply remains strong, with plentiful availability across nearly all product lines, as we continue to meet customer requirements and support patient care.”

“Our work continues around the clock, in close cooperation with cybersecurity experts, government agencies, and industry partners, as our investigation proceeds, reflecting a shared dedication to safeguarding the healthcare ecosystem and supporting ongoing recovery efforts,” the company added.

This announcement follows a previous statement made on March 23, where the company indicated its teams were prioritizing the restoration of systems critical for customer, ordering, and shipping operations.

Although it was initially suspected that no malicious tools were employed, Stryker later disclosed the discovery of a malicious file used to conceal malicious activity within the company’s network, which was found by security experts assisting with the investigation.

Handala (also referred to as Handala Hack Team, Hatef, Hamsa) emerged in December 2023 and is believed to be an Iranian-affiliated, pro-Palestinian hacktivist group targeting Israeli organizations with data-wiping malware for both Windows and Linux systems.

The group has been linked to Iran’s Ministry of Intelligence and Security (MOIS) and is also known for publicly releasing stolen sensitive information from compromised systems.