Stryker Cyberattack: Alleged Iran-Linked Group Handala Causes Outage

A cyberattack allegedly linked to Iran ‑aligned hackers disrupted global operations at Stryker, a major U.S. medical technology company, leaving thousands of employees unable to access work systems and forcing a widespread shutdown of network‑connected devices.

Irish media and cybersecurity analysts reported that internal systems displayed branding associated with “Handala,” a hacktivist label often described as Iran‑linked. Stryker has not confirmed who was responsible, and officials cautioned that attribution remains under investigation.

The attack comes nearly two weeks after the U.S. and Israel launched strikes against Iran, sending the region into conflict that continued on Wednesday .

Strker said it is experiencing a "global network disruption affecting the Windows environment" in a statement reported by Irish news outlet Cork Beo.

"Our teams are actively working to restore systems and operations as quickly as possible. Stryker has business continuity measures in place, and we’re committed to continuing to serve our customers," the statement said.

In a message to employees, the company said it is "experiencing a severe, global disruption impacting all Stryker laptops and systems that connect to our network," the news outlet reported.

The disruption left employees in multiple countries unable to access email, internal tools and work devices. Irish outlets said the outage affected thousands of workers, including staff at Stryker’s large operations in Cork, Ireland , one of the company’s biggest international hubs. Ireland’s National Cyber Security Centre said it has been notified and is assisting with the response.

It was unclear why Stryker was targeted.

The Irish Examiner described the attack as a "wiper" attack, which is when data on an IT system is wiped out.

Crowdstrike describes wiper attacks as "a form of malware engineered to destroy or corrupt data on targeted systems." They can cause irreversible damage by deleting "critical files and data" and cause "severe business disruptions."

"In a typical case, a wiper attack begins with infection vectors such as phishing emails, malicious downloads, or compromised websites. These initial entry points serve as the gateway for wiper attack malware to infiltrate a targeted system. Phishing emails are crafted to appear legitimate, tricking the unsuspecting recipient into installing malware on their system. In other cases, attackers may exploit a software vulnerability or use a compromised website to deliver malware to a target system," reads CrowdStrike's webpage on wiper attacks.

The outages began shortly after midnight on the East Coast, reported The Wall Street Journal.

Stryker is a global medical technology company headquartered in Portage, Michigan .

It specializes in products and services that span orthopedics, surgical equipment, neurotechnology, and spine care. The company operates in more than 75 countries and employs tens of thousands of people worldwide.

Its portfolio includes advanced medical devices, implants, and hospital systems that are critical to patient care, making it a key player in the healthcare sector. In Ireland, Stryker has a significant presence, with multiple manufacturing and research facilities in Cork and Limerick, serving as major hubs for its European operations.

It has 56,000 employees across the globe, according to its company website. It has been reported to have $25 billion in revenue in 2025. Its biggest hub outside of the U.S. is Cork, reported Cork Beo.

The IBM X-Force Exchange identifies Handala as a "pro-Palestinian, Iran‑aligned hacktivist threat group that emerged in late 2023 following the onset of the Gaza conflict."

"Handala employs a broad and evolving toolkit, including phishing, custom wiper malware, ransomware‑style extortion, data theft, and hack‑and‑leak activity. Its campaigns consistently feature ideological messaging, inflated or misleading breach claims, and deliberate targeting of life‑critical sectors such as healthcare and energy," according to IBM.

It has also targeted financial services, satellite communications, military-adjacent technology firms and governmen entities, IBM has reported.

It also claimed responsibility for hacking israel's Academy of the Hebrew Language website, according to Cork Beo.

The Jerusalem Post reported that the website said, “There is no need to learn Hebrew anymore. You won’t need it for much longer." It also had a logo of the Handala group, according to the publication.

A report from the Center for Strategic & International Studies found that Iran has “historically relied on” cyber operations and that the February 28 strikes were “more likely to mark the beginning of a new phase of cyber escalation than its conclusion.”

“The most recent escalation triggered what has been called the most aggressive use of Iran’s state-directed “Great Epic” cyber campaign, as part of the broader Cyber Islamic Resistance ideological framework. Iran’s capacity to execute this campaign is well-documented, given its demonstrably sophisticated cyber capabilities: wiper attacks, distributed denial-of-service attacks against major U.S. banks, election interference campaigns, and the more recent exploitation of industrial control systems,” the report reads.

It was not clear when the attack would be resolved. CrowdStrike noted that wiper attacks may have permanent damage for data with no means of recovery.

The company’s stocks have fallen 4 percent by 11:45 a.m. on Wednesday, as investors reacted to reports of the cyberattack.

Update 3/11/2026 11:53 a.m. ET: This article was updated with additional information.