Iran-Linked Hackers Hit US Medical Giant Stryker: Handala Claims 50TB Massive Cyberattack, Calls It ‘New Chapter in Cyber Warfare’

An Iran-linked hacking group on Wednesday claimed responsibility for a damaging cyberattack on U.S.-based medical device and services company Stryker, according to messages shared on the group’s Telegram channel.

The Michigan-headquartered firm, which employs around 56,000 people and operates in 61 countries, said in a filling with the SEC that the attack had disrupted certain systems and limited access to some services. 

The company added that it is still working to restore operations fully, and a timeline for complete recovery has not yet been determined. 

Did Iran-Linked Hackers Target Stryker’s Systems?

Staff and contractors said in social media posts that the logo of an Iran-linked hacking group has appeared on the company’s login pages. Reuters was not able to verify the posts.

“We have no indication of ransomware or malware and believe the incident is contained,” a company spokesperson said, without commenting on who may have been behind the attack. Calls to the company’s global headquarters in Portage, Michigan, were answered with a recording that said the company is “currently experiencing a building emergency.”

Are Iranian Cyber Proxies Targeting U.S. Companies?

Stryker SYK.N shares ended down 3.6% on Wednesday.Fears have mounted that Iran, which has sophisticated cyber espionage capabilities, might retaliate against U.S. or Israeli entities after the two countries began airstrikes against it.

“This is exactly the type of attack we have been worried about: Iranian proxies using destructive cyber attacks like data deletion against U.S. companies to retaliate,” said Cynthia Kaiser, senior vice president of cybersecurity firm Halcyon’s Ransomware Research Center and a former senior FBI cyber official.

Did Handala Target Stryker Over U.S.-Israeli Strikes on Iran?

Handala, an Iranian-linked hacking persona that has claimed multiple attacks on targets in Israel and around the world, said in a message posted to its Telegram channel that it was responsible for the attack, which was in response to the strike on the Minab school in southern Iran “and ongoing cyber assaults.”

The group did not respond to a request for comment sent to one of its messaging accounts.

The girls’ school in Minab was hit on the first day of U.S.-Israeli attacks on Iran, killing an estimated 150 students, according to Iran’s ambassador to the U.N. in Geneva, Ali Bahreini. Reuters has not independently verified the figure.

Did Hackers Erase Data From Stryker’s Windows Systems?

The outages on Stryker’s network began shortly after midnight on Wednesday on the East Coast, the Wall Street Journal reported, citing people familiar with the matter.

The company’s staff found that remote devices running Microsoft’s Windows operating system, including cellphones, laptops and others configured to connect to Stryker’s technology systems, had been wiped.

Is the Trump Administration Tracking Iranian Cyber Threats?

A White House official said: “(The) Trump administration is always proactively monitoring potential cyber threats and driving a response with our world-class critical infrastructure, regulatory agencies and law enforcement entities.”

The FBI and the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency did not respond to requests for comment.

Is Handala Iran’s Most Notorious State-Linked Hacking Group?

Handala has been linked to multiple hack-and-leak operations as well as disruptive attacks, including cases in which data was destroyed, Israeli cybersecurity firm Check Point said in a report Tuesday.

“They are the most notorious group affiliated with the Iranian regime,” Check Point Chief of Staff Gil Messing said in an email.

Messing added that Check Point has tracked the group for years and believes they operate under Iran’s Ministry of Intelligence.

“The fact they publicly take responsibility on this attack, and the fact they know they are linked to the government, show a new phase in Iran’s motivations.”

(Inputs from Reuters)

Also Read: Creek Harbor Tower In UAE Attacked By Iran After Tehran Hit Dubai International Airport, IRGC Expanding Attacks Across The Gulf