Stryker says it's restoring systems after pro-Iran hackers wiped thousands of employee devices | TechCrunch

"A pro-Iran hacking group called Handala took credit for the destructive breach, claiming its hack was in response to a U.S. air strike on an Iranian school that killed at least 175 people, mostly children. The hackers also defaced the company's login pages with its own logo."

"According to Bleeping Computer, the Handala hackers may have broken in using an internal Stryker administrator account that granted them near-unlimited access to the company's Windows network. The hackers allegedly accessed the company's Microsoft InTune dashboards, which allows the remote management of employee laptops and mobile devices, such as deleting data in case an employee's device is lost or stolen."

"A successful compromise of the company's InTune dashboards would have allowed the hackers to remotely wipe employee phones and laptops, including personal devices, without using malware."

Stryker, a major medical technology company, experienced a significant cyberattack on March 11 attributed to pro-Iranian hacking group Handala. The breach compromised internal Microsoft environments and allowed attackers to remotely wipe tens of thousands of employee devices, causing widespread operational disruption. The hackers allegedly gained access through a compromised administrator account, enabling them to access Microsoft InTune dashboards used for device management. Stryker confirmed its internet-connected medical products remain safe and found no ransomware or malware, though order processing, manufacturing, and shipping capabilities were disrupted. Handala claimed responsibility, stating the attack responded to a U.S. airstrike on an Iranian school. The breach represents a significant cybersecurity incident targeting critical infrastructure.

Read at TechCrunch