Data-Wiping Focused Cyberattack on Stryker

Medical technology company Stryker announced that it has returned to a fully operational status in its production network following the cyberattack it experienced in 2026 that disrupted its global operations. In the company's update, it was stated that commercial systems, ordering, and distribution processes have been restored, and production is rapidly progressing toward peak capacity.

It is reported that the attackers accessed Stryker's internal Microsoft environment and allegedly compromised a Microsoft Intune administrator account, executing wipe commands on tens of thousands of systems and servers. The group claimed on a blog that more than 200,000 systems, servers, and mobile devices were wiped; furthermore, critical data was exfiltrated.

According to Stryker's own statements, the incident remained confined to the company's internal corporate environment. The company reported that its products and connected medical technologies were not affected, there was no evidence of the incident spreading to customer or partner systems, and the investigation is ongoing alongside public authorities and third-party cybersecurity experts. In its March 23 update, it was stated that initially "no signs of ransomware or malware" were observed, but it was later determined that the threat actor used a malicious file executing commands to conceal their activity.

It is stated that the data-wiping aspect of the attack created an operational impact, causing temporary disruptions in some ordering and shipping processes, and that some customers using custom-made implants were affected by delays. Despite this, Stryker emphasizes that the overall product supply remains healthy and that they continue to support patient care.

Some of the precautions we need to take to protect against these types of attacks include:

• Do not open emails from untrusted sources.

• Use multi-factor authentication (MFA).

• Keep your system updated to the latest version at all times.

• Monitor login logs regularly.

• Track the security of mobile devices.

  
  

For detailed information, you can reach out to our experts at info@zerosecond.com.ae