Several sue Stryker after cyberattack, alleging company failed to protect sensitive data

PORTAGE, Mich. — A cyberattack at Stryker Corporation has sparked multiple lawsuits, which include a current employee, alleging the company failed to adequately protect sensitive personal information.

At least four lawsuits have been filed against the Portage-based medical technology company, the most recent being filed Thursday.

The legal actions raise questions the scope of the attack, the adequacy of Stryker’s cybersecurity measures, and how long the threat may have gone undetected.

Stryker confirmed that a “threat actor” was able to infiltrate its systems and hid their activity behind a malicious file, prompting an internal investigation and system restoration.

While the company says the breach is now contained, plaintiffs argue the safeguards in place were insufficient.

Rich Miller, CEO of Stack Cybersecurity in Livonia, says the breach appears severe and the risks to employee information are significant.

“It is very serious. In fact, there was just a class action lawsuit filed against Stryker," Miller said. "There were four leak sites seized by the FBI today, and you don’t have leak sites if you didn’t gain any information."

Miller explained that personal and health information, including Social Security numbers and other identifiable information, could easily be exploited.

“There’s PII, there’s PHI, all of that information makes it very easy to attack victims,” he said.

Experts say cyberattacks of this scale often aim to collect large amounts of data for further exploitation or sale.

Miller noted that Social Security numbers alone can be purchased on the dark web for as little as $5 to $10 each.

“When you have a pool of 10,000 names to target, one individual can be taken for $3,000 in a couple hours,” Miller said.

The lawsuits raise questions whether Stryker’s containment and cybersecurity measures were adequate.

Miller cautioned that even when a breach is declared contained, residual threats may remain.

"If the files are well hidden and there’s nothing happening now, it’s hard to say it’s contained because it’s not rearing itself,” Miller said, noting that malicious files can remain dormant and undetected for months.

Miller also highlighted steps companies can take to better protect sensitive data.

“You would want endpoint detection and response, managed detection and response, and a 24-7 Security Operations Center where people are monitoring the network all the time," he said. "Ultimately, you need SIM running and enabled, you have to start scanning all of this data."

Attorneys representing the plaintiffs say the breach goes beyond theoretical risk.

Inquiries focused on whether employee data was actually accessed or simply exposed, and what evidence supports claims that Stryker’s cybersecurity measures were inadequate.

Legal teams are also exploring whether additional employees could be affected and whether class-action status is warranted.

As the lawsuits progress, key questions remain the total scope of the breach, how long the threat actor had access to company systems, and whether stronger safeguards or earlier detection could have prevented the incident.

Stryker has declined to on pending litigation.