TLDR

  • Handala, a hacking collective with ties to Iran, took credit for breaching Stryker’s systems on March 11, 2026
  • The medical device manufacturer experienced widespread network disruptions affecting multiple systems and business applications globally
  • Hackers stated they eliminated data on more than 200,000 devices and took 50TB of information as retaliation for airstrikes on a Minab school
  • Company officials confirmed no ransomware or malware presence and stated they have the situation under control
  • Shares of SYK fell 3.6% on Wednesday as news of the breach emerged

A devastating cyberattack struck Stryker, the Michigan-headquartered medical technology company, on March 11, crippling portions of its worldwide infrastructure and triggering a 3.6% decline in share value.

According to an SEC filing, the breach severed connections to various information systems and business platforms. The company provided no estimated timeframe for complete service recovery.


SYK Stock Card
Stryker Corporation, SYK

Employees and contractors took to social media platforms to report seeing the emblem of an Iran-affiliated hacking organization on company login screens. Anyone calling the Portage, Michigan headquarters received an automated message indicating the facility was “currently experiencing a building emergency.”

Company representatives confirmed the absence of ransomware or malware in their systems and expressed confidence that they have successfully contained the breach. The disruption reached their Cork, Ireland manufacturing site — home to over 4,000 workers — along with operations in Limerick and Belfast.

Handala, the Iran-affiliated collective, announced their involvement through Telegram and X social media channels. The organization characterized the attack as revenge for military action against the Minab girls’ school in southern Iran, where Iranian authorities claim approximately 150 students died during the opening day of U.S.-Israeli military operations against Iran starting February 28. Reuters has yet to confirm this casualty count independently.

The hacking group asserted they destroyed data on over 200,000 systems, servers and mobile devices while taking 50TB of information. They further claimed Stryker locations across 79 nations were compelled to cease operations. The company has yet to validate these particular assertions.

What Happened on the Ground

The Wall Street Journal documented that disruptions commenced shortly after midnight Eastern time on Wednesday, cascading across global operations from that point. Windows devices operating remotely — encompassing laptops and smartphones linked to Stryker’s infrastructure — had their data erased.

Cynthia Kaiser, a former senior FBI cyber official now at Halcyon, said: “This is exactly the type of attack we have been worried about: Iranian proxies using destructive cyber attacks like data deletion against U.S. companies to retaliate.”

Handala maintains an established history of cyber operations. Check Point, an Israeli cybersecurity organization, released research Tuesday connecting the collective to numerous hack-and-leak campaigns and destructive attacks featuring data elimination.

Check Point’s Chief of Staff Gil Messing said the group operates under Iran’s Ministry of Intelligence and called them “the most notorious group affiliated with the Iranian regime.” He said publicly claiming the attack signals “a new phase in Iran’s motivations.”

White House and Verifone

The White House said the Trump administration is “proactively monitoring potential cyber threats” and coordinating with critical infrastructure and law enforcement agencies. The FBI and CISA did not respond to requests for comment.

After targeting Stryker, Handala announced they had compromised Israeli fintech company Verifone. Verifone rejected this claim, stating their investigation uncovered zero evidence of any breach and confirmed uninterrupted service delivery to all clients.

Ken Sheehan, director of operations at Smarttech247, highlighted that phishing continues to be Handala’s primary infiltration technique and recommended organizations strengthen their cybersecurity awareness programs.

Stryker maintains approximately 56,000 employees spanning 61 nations and generated over $25bn in revenue during the previous year.