Policy & Regulation

Iran-Linked Hackers Just Wiped 200,000 Medical Devices Across 79 Countries — And Used the Company's Own System to Do It

By BHC, Editor in Chief · April 02, 2026 · 5 min read

BHC, Editor in Chief — Iran-Linked Hackers Just Wiped 200,000 Medical Devices Across 79 Countries — And Used the Company's Own System to Do It

Summary

  • Pro-Iranian hackers wiped over 200,000 Stryker medical devices globally on March 11, 2026, using the company's own device management system. Here is what happened, how it happened, and what it means for Indian hospital cybersecurity.

At 3:30 AM on March 11, 2026, something extraordinary and deeply alarming happened across the global healthcare technology landscape. The pro-Iranian hacktivist group Handala, using compromised administrator-level credentials, logged into Stryker Corporation's Microsoft Intune device management platform and sent a single command to every enrolled device on the network: wipe. Within hours, more than 200,000 systems — servers, laptops, mobile devices, and corporate endpoints across 79 countries — had been erased. No malware was deployed. No zero-day vulnerability was exploited. The attackers used Stryker's own legitimate systems against itself.

"Every organisation today, right now, needs to be running a full hands-on deck rehearsal of what happens if they have a similar event."

Stryker is not a peripheral player in global healthcare. The Michigan-based medical technology company makes hospital beds, surgical equipment, defibrillators, ambulance cots, and critical communications systems used in emergency medicine. It serves more than 150 million patients worldwide through its equipment and services. When Stryker's systems went dark, hospitals did not just lose administrative capability — they lost clinical infrastructure.

**How the Attack Actually Worked

This attack represents a new and deeply concerning category of cyber threat that security professionals call 'living off the land.' The attackers did not need to break into individual devices. They did not need to deploy ransomware or exploit software vulnerabilities. They simply needed access to one set of administrator credentials for the cloud management platform that Stryker used to remotely manage all its devices.

Once inside Handala had access to the master control panel. They issued legitimate wipe commands — the kind Stryker itself would use if a device was reported stolen — to every device simultaneously. The devices did exactly what they were designed to do when receiving an authenticated command from a central server. The attack weaponised the company's own security infrastructure.

Investigators believe the initial access was obtained through phishing — a technique where targeted emails trick employees into providing login credentials. IBM and Palo Alto Networks, both analysing the incident, noted that Handala has a documented history of phishing-based initial access. The lesson is one that cybersecurity professionals have been repeating for years: the most sophisticated attacks often begin with the simplest human errors.

**The Patient Safety Dimension

What makes this attack particularly alarming is not the scale of devices wiped — though 200,000 is extraordinary — but the impact on patient care. In Maryland, the state's emergency medical services agency confirmed that Stryker's Lifenet system — used by paramedics to transmit ECG readings to hospitals in real time — became non-functional across most of the state. The workaround? Paramedics called hospitals by radio and verbally described what they were seeing on the ECG screen. Emergency medicine in 2026 running on 1980s backup procedures.

Stryker later clarified that Lifenet runs on separate infrastructure and was not directly affected by the wipe. But if paramedics in Maryland lost Lifenet functionality, something in the broader Stryker network disruption cascaded into that system. The distinction between 'directly affected' and 'functionally disrupted' may matter legally but does not matter to the patient in the ambulance.

**The Geopolitical Context

The attack has been formally attributed by the US Department of Justice to Iran's Ministry of Intelligence and Security, with Handala acting as a front. The State Department is offering $10 million for information on the perpetrators. The timing is not coincidental — the attack came amid escalating US-Iran tensions following a military strike. Healthcare is being used as a geopolitical weapon. This should alarm healthcare leaders everywhere.

**What Indian Healthcare Must Do Now

India's hospital networks are not immune to this category of attack. Several large Indian hospital chains use international medical device and technology vendors with cloud-connected management platforms. The same attack surface that was exploited at Stryker exists in any healthcare organisation that uses cloud-based device management without robust multi-factor authentication and privileged access controls.

Chris Krebs, former director of the US Cybersecurity and Infrastructure Security Agency, issued an immediate warning: every organisation needs to run a full rehearsal of what happens if they face a similar event. The American Hospital Association advised hospitals to restrict or closely monitor connectivity between hospital networks and vendor-managed systems, verify fallback procedures for all critical medical devices, and heighten vigilance for phishing attempts.

**BHC Perspective

For Indian hospital CIOs, IT heads, and healthcare administrators, the Stryker attack is a watershed moment. The question is no longer whether Indian healthcare will face this category of cyberattack — it is when. Hospitals that have not conducted a comprehensive cybersecurity audit of their device management infrastructure, vendor connectivity, and clinical downtime procedures should treat this as an urgent priority. The investment in prevention is a fraction of the cost of a breach that disrupts patient care.

**Frequently Asked Questions

Q: What happened in the Stryker cyberattack?
A: On March 11, 2026, pro-Iranian hackers from the group Handala used compromised administrator credentials to access Stryker's Microsoft Intune device management platform and simultaneously wipe over 200,000 devices across 79 countries.

Q: Did the Stryker cyberattack affect patient care?
A: Indirectly yes. In Maryland, paramedics temporarily lost the ability to transmit ECG readings to hospitals via Stryker's Lifenet system, forcing them to use radio communication as a backup. Hospitals across Michigan took precautionary measures with Stryker equipment.

Q: What can Indian hospitals learn from the Stryker attack?
A: Indian hospitals should audit all vendor-connected device management systems, ensure multi-factor authentication is in place for all administrative accounts, establish clinical downtime procedures for critical devices, and conduct regular cybersecurity rehearsals.