Medical technology giant Stryker Corporation (NYSE: SYK) was hit by a massive, destructive cyberattack that crippled its global operations and irretrievably wiped data from over 200,000 devices.

Impact on Global Operations

The attack caused widespread shutdowns across Stryker’s network, which spans over 60 countries and employs approximately 56,000 people.

• Widespread Destruction: Hackers deployed a “wiper” attack, which permanently erases data rather than encrypting it for ransom.
• Wiped Devices: Thousands of enterprise systems—including Windows laptops, servers, and mobile phones connected via Microsoft Intune—were remotely wiped.
• Office Closures: Stryker was forced to shut down offices in 79 countries as employees were unable to log in to internal software, email, or manufacturing systems.
• Facility Impacts: The company’s largest hub outside the U.S., located in Cork, Ireland, was severely impacted, with thousands of workers sent home and some manufacturing lines halted.

Attribution and Retaliation

The Iran-linked hacker group Handala (or Handala Hack) has claimed responsibility for the operation.

• Stated Motive: The group framed the attack as retaliation for a reported U.S./Israeli missile strike on a school in Minab, Iran, and ongoing “cyber assaults against the infrastructure of the Axis of Resistance”.
• Data Exfiltration: Handala claims to have extracted 50 terabytes of critical data, stating it is now “in the hands of the free people of the world”.
• Defacement: Victims reported seeing the Handala logo on their device login screens as systems went dark.

Financial and Market Response

The news of the disruption caused an immediate negative reaction in the financial markets.

• Stock Drop: Shares of Stryker Corporation (SYK) fell between 3% and 5% during Wednesday’s trading session following reports of the breach.
• Corporate Statement: Stryker confirmed a “global network disruption to [their] Microsoft environment” but initially stated they had “no indication of ransomware or malware” and believed the incident was contained.

Geopolitical Context

Security analysts view this as a significant escalation in nation-state cyber warfare. Unlike typical cybercrime, this attack focused on sabotage and economic disruption rather than financial gain through extortion. The targeting of a major medical supplier raises critical concerns regarding the safety of the global healthcare supply chain.