An Iran-linked hacker group has claimed responsibility for a cyberattack on US medical device manufacturer Stryker Corporation, causing global disruption to its systems. The group, known as Handala, said the attack was in retaliation for the bombing of a school in Minab, Iran, an incident that has drawn international condemnation.
Stryker, based in Michigan, confirmed the attack on Wednesday, stating that it had caused disruptions and limited access to certain information systems and business applications. The company said it had no indication of ransomware or malware and believed the incident was contained. However, the timeline for full restoration remains unknown.
The attack prompted a roughly 3 per cent drop in Stryker’s share price. Handala claimed it had wiped thousands of systems and mobile devices and extracted 50 terabytes of data, though no evidence was provided. The group described Stryker as a “Zionist-rooted corporation”.
Cybersecurity firm Sophos identified Handala as an Iranian hacktivist persona first observed in 2023. The group has previously targeted Israeli entities and has claimed attacks on oil and gas organisations in Israel, Jordan and Saudi Arabia. Intel 471, a threat intelligence company, noted that the surge in pro-Iranian hacktivism provides Tehran with a means to project power amid constrained domestic connectivity.
Lee Sult, chief investigator at Binalyze, described the incident as “the first drop of blood in the water” as the Iran conflict extends to US cyber targets, predicting further attacks. Stryker’s investigation into the breach is ongoing, with the full financial and operational impact yet to be determined.
