Suspected Iran-linked cyberattack disrupts US medical technology firm
Hackers claim responsibility for breach that reportedly wiped employee devices at Michigan-based company
By Abdullahi Yusuf
A cyberattack believed to be linked to Iranian hackers has disrupted operations at the US medical technology firm Stryker, in what analysts say could be the first significant attack against an American company since tensions between the United States and Iran escalated into open conflict.
The Michigan-based manufacturer, which produces medical equipment and digital health technology used in hospitals around the world, confirmed that a cyberattack had affected parts of its corporate network.
In a statement posted on its website, the company said it was experiencing a “global network disruption” affecting its Microsoft environment but stressed there was no evidence that ransomware or malware had compromised its core systems.
“We have no indication of ransomware or malware and believe the incident is contained,” the company said.
A hacking group calling itself Handala Team claimed responsibility for the attack in posts on social media platforms including Telegram and X. Cybersecurity researchers say the group has previously been linked to operations connected to Iran’s intelligence apparatus.
The group has a history of publicising its alleged cyber operations online, often boasting about breaches and data access.
According to cybersecurity experts, the method used in the attack suggests the hackers may have gained access to a device-management system used by companies to control employee devices remotely.
Rafe Pilling, director of threat intelligence at the cybersecurity firm Sophos, said available evidence indicated the attackers may have accessed the company’s management console for corporate devices.
“They appear to have obtained access to the Microsoft Intune management console,” Pilling said, referring to a cloud-based service used to manage company devices.
Such systems allow administrators to remotely reset, disable or erase devices that are lost, stolen or compromised.
“If that access is obtained by an attacker, the same tools can be used to wipe devices across an organisation,” he said.
A person familiar with the incident said work-issued phones used by employees suddenly stopped functioning during the disruption, halting internal communications.
Cybersecurity specialists say the attackers appear to have triggered a remote wipe command that reset some devices to factory settings, a feature typically intended to protect corporate data if hardware is lost.
The feature is commonly used by organisations to retire devices or securely erase information.
Iran has a long history of cyber operations targeting regional rivals and Western institutions.
One of the most notorious attacks occurred in 2012 when hackers deployed destructive “wiper” malware against Saudi Aramco, Saudi Arabia’s national oil company, destroying data on tens of thousands of computers.
Another high-profile attack targeted the Las Vegas Sands Casino in 2014, reportedly in retaliation for comments made by its owner about Iran.
Since the outbreak of hostilities between the United States and Iran, cybersecurity firms say most activity linked to Iranian groups had been limited to low-level website defacements or online propaganda.
Technology companies including Google and the email security firm Proofpoint have previously reported that many Iranian cyber operations during the conflict appeared to focus primarily on espionage rather than destructive attacks.
The incident involving Stryker may therefore signal a shift toward more disruptive cyber operations, analysts say.
It remains unclear exactly how the attackers gained access to the company’s systems or whether any sensitive data was compromised.
Neither Stryker nor Microsoft has provided detailed information about the breach.
Experts say investigations into major cyber incidents can take weeks or months before the full scope becomes clear.
For now, the incident highlights how cyber operations are increasingly becoming part of modern geopolitical conflict, often unfolding quietly behind the scenes while physical battles dominate the headlines.
With additional information from NBC News
SPONSORED
SPONSORED
