Volume 2Manufacturing edition2026Last verified 13 sources, 10 primaryClaimed by Handala
In March 2026 an intrusion into Stryker’s corporate network stopped a global medical device maker from making product for almost three weeks. Nothing on the record says a machine or a controller was touched.
Everything on Stryker’s record is corporate: its network, a Microsoft environment, an identity directory, servers and workstations. It did not believe its connected products were affected, and its filings never mention operational technology. Yet its chief executive said the company could not make product for almost three weeks. That is an IT compromise halting physical operations, and nothing on the record supports a higher rung.
Why the plants stopped is not disclosed. BlastWave’s reading, which is analysis and not a disclosed fact, is that a modern plant takes its orders, labels, lot records and shipping authority from the same corporate login everyone else uses. Remove that login and a line with nothing wrong with it has nothing it is allowed to build or send. Stryker filed the same day and recovered well. The question it leaves every manufacturer is whether anyone built a way to make and ship product for a week without the corporate login.
What is not known: Stryker has not said how the intruder got in, which account or tool was used, or why production depended on the systems that went down. It names no attacker. Handala claimed the attack, and the Justice Department says Iran’s intelligence ministry used Handala’s website to claim credit, without naming Stryker. No dollar cost has been disclosed, and nothing separates the incident’s effect on earnings from tariffs and interest. The device counts and data volumes in coverage are in no filing.
Recommendation
Take the path away from production Systems that tell a line what to build, label and ship should not share an identity plane and endpoint fleet with email, so one corporate account has no route to them.
Remove standing fleet-wide authority No single administrator identity should be able to wipe or reconfigure every device at once. Destructive actions need a second approver and phishing-resistant sign-in.
Send orders down one way Orders and schedules reach the plant over a one-way path into a local copy, and the plant rehearses a week of making and shipping with the corporate login gone.
Sources: Form 8-K, 11 Mar 2026 (Item 8.01); Form 8-K, 23 Mar 2026 (Ex. 99.1, Unit 42); Form 8-K/A, 9 Apr 2026 (Item 1.05); Q1 call transcripts, 30 Apr 2026; CISA alert, 18 Mar 2026; DOJ release, 19 Mar 2026.. Full list with links.
Soft Spots: That the plants depended on corporate identity and endpoints is BlastWave’s analysis. DOJ attributes Handala’s claim to the MOIS without naming Stryker; that is not a finding of who did it. Call quotes are third-party transcripts.
The full record
Every claim numbered to its source. Last updated .
An intrusion into the corporate network stopped a global medical device maker from making product for almost three weeks, though nothing on the record says a machine was touched. What is verified, what is only reported, and what is still unknown.
Summary
In March 2026, an intrusion into the corporate network of Stryker, the Michigan-based medical device maker, disrupted order processing, manufacturing and shipping; its chief executive said it could not make product for almost three weeks. Nothing on the record says a production machine, controller or connected product was reached. A persona called Handala claimed the attack; Stryker names no attacker.4,5,8
Timeline of the Stryker incident
Every date is tied to a source. Press reporting appears only as evidence of what was said.
Stryker identifies a cybersecurity incident and files a Form 8-K the same day, describing a "global disruption to the Company's Microsoft environment," "no indication of ransomware or malware," and a materiality decision not yet made.1TechCrunch reports that a persona called Handala claims the attack.8
A second 8-K records the CISO's update to customers: operations "continue to be disrupted, including its order processing, manufacturing and shipping," and the company does not believe patient-related services were disrupted or connected products impacted.4 The American Hospital Association says it is not aware of direct impacts to US hospitals, and that this could change.11
CISA publishes an alert urging endpoint management system hardening, including multi-admin approval for device wipes in Microsoft Intune. As republished, it names Stryker.12
The Justice Department seizes four domains and says Iran's Ministry of Intelligence and Security used the Handala domain to claim credit for a March 2026 destructive malware attack on an unnamed US-based medical technologies firm.7
Palo Alto Networks Unit 42 dates its letter describing "a security compromise involving impacts to Stryker's Entra ID environment, servers, and workstations," with no unauthorized activity identified since 11 March. Stryker publishes it three days later.3
Stryker files again, revising its 11 March position: the actor "used a malicious file to run commands which allowed it to hide its activity," a file not capable of spreading. The scope widens to the corporate network environment.3
Fully operational across the global manufacturing network, as the chief executive later told investors.5
Stryker amends its first 8-K to add Item 1.05: a material impact on operations, with resulting impact on first quarter results, and not material to full-year guidance. Manufacturing is fully operational and ordering and distribution systems restored.6
First quarter results: adjusted EPS down 8.5% to $2.60; full-year guidance maintained.10 On the call, the chief executive says the company "could not make product for almost three weeks."5
The first quarter 10-Q records a cybersecurity incident "which caused disruptions to our business operations" and "idle production time."9
Second quarter results: organic net sales up 9.0%, and "significant progress in our recovery from the cyber incident."13
Key facts and their status
Verified sworn, filed or published by the primary party. Reported rests on press, researchers or unnamed sources. Undisclosed no one has stated it.
Question
What the record says
Status
What was reached?
The corporate network, including the Microsoft environment; per Unit 42, Entra ID, servers and workstations3
Verified
Were production machines or control systems reached?
Not on the record. No filing describes it, and none from 2025 to 2026 mentions operational technology or industrial control2,3
Verified (absence in filings, as of September 2026)
The Justice Department attributes the claim, through the Handala domain, to Iran's MOIS, without naming Stryker7
Verified (the claim, not the deed)
How did the intruder get in?
Not stated in any filing, exhibit or government document
Undisclosed
What malware?
An unnamed malicious file, not capable of spreading; no family or tool named3
Verified
Device counts and data volume
In no Stryker filing. The largest figures in coverage trace to Handala's claim as reported8
Claim only
Was it material?
Material impact on operations, with resulting impact on Q1 2026 results; not material to full-year guidance6
Verified
Incident cost
No dollar figure disclosed
Undisclosed
Time to full operation
About three weeks: fully operational by the week of 1 April, and as of 9 April per the 8-K/A5,6
Verified
Were Stryker's factories or medical devices hacked?
Nothing on the record says a production machine, a controller or a connected product was reached. Everything Stryker disclosed is corporate IT. Its first filing described a disruption to "the Company's Microsoft environment"; its 23 March filing widened that to "the Company's corporate network environment, including but not limited to the Microsoft environment."1,3 The responder's letter, which Stryker filed as an exhibit, describes "a security compromise involving impacts to Stryker's Entra ID environment, servers, and workstations."3
On the products in the field, the company's 12 March filing records that it:
"does not believe that its patient-related services have been disrupted or that its connected products were impacted by the incident."
A full-text search of Stryker's SEC filings from 2025 to 2026 returns no result for "operational technology" and none for "industrial control."2 This is a statement about the record, not a finding that no machine was touched.
Why did Stryker stop making product?
Stryker has not said; its filings record that manufacturing was disrupted and production sat idle. The 12 March filing says operations "continue to be disrupted, including its order processing, manufacturing and shipping."4 The first quarter 10-Q refers to "idle production time."9 On the earnings call, the chief executive put a length on it:
"we could not make product for almost three weeks"
The chief financial officer, Preston Wells, said adjusted gross margin of 63.6%, 190 basis points lower, reflected "lost manufacturing absorption from production shutdowns due to the cyber incident as well as the impact of tariffs."5 The call quotations come from two independent third-party transcripts, which agree on this wording, not from a Stryker-published transcript.
Why production depended on the systems that went down is not disclosed. BlastWave's reading of that dependency is set out, and labelled as analysis, below.
Did Iran attack Stryker?
The record supports a narrower statement: Handala claimed the attack, and the Justice Department says Iran's Ministry of Intelligence and Security used the Handala domain to make that claim. On 11 March 2026 a persona called Handala claimed responsibility, as reported by TechCrunch.8 On 19 March the Justice Department announced the seizure of four domains. Its release says the MOIS used the Handala domain:
"to claim credit for a March 2026 destructive malware attack against a U.S.-based multinational medical technologies firm."
The release does not name Stryker, and the sentence is about who made the claim, not a finding about who carried out the attack. Stryker names no actor in any filing.6,7
Did the Stryker incident affect hospitals or patients?
No statement from Stryker or any regulator we could find says hospitals or patients were harmed. On 12 March 2026 Stryker said it did not believe its patient-related services had been disrupted.4 The same day the American Hospital Association, which is not a regulator, said it was not aware of direct impacts to US hospitals, and that this could change.11 No FDA or HHS statement was found as of late September 2026.
On the 30 April call the chief executive said "we did lose some cases" when representatives could not be present.5 That refers to lost business, as said on a call. It is not evidence about patient outcomes in either direction. Whether any procedure was delayed is not on the record.
What did Stryker correct in its own disclosure?
Twelve days after its first filing, Stryker replaced its day-one statement on malware, in writing, and gave the reason. On 11 March it reported "no indication of ransomware or malware and believes the incident is contained."1 On 23 March it said that early in the investigation management had believed the incident did not involve ransomware or malware, and that further in, working with Palo Alto Networks Unit 42, it found the actor:
"used a malicious file to run commands which allowed it to hide its activity"
The same filing describes the file as not capable of spreading, widens the scope from the Microsoft environment to the corporate network environment, and publishes the responder's letter.3 A day-one filing is a snapshot of what a company knew on day one. Stryker superseded its snapshot and said why, which makes its filings more trustworthy, not less.
How much did the Stryker incident cost?
Stryker has disclosed no dollar cost. Its amended 8-K says the incident "had a material impact on its operations, with resulting impact to the Company's financial results for the first quarter of 2026," and has not had, and is not reasonably likely to have, a material impact on full-year guidance.6
First quarter 2026 net sales rose 2.6% to $6.0 billion, organic net sales rose 2.4%, and reported EPS rose 14.2% to $1.93. Adjusted EPS fell 8.5% to $2.60, and full-year guidance was maintained. No reconciliation line names the incident.10 The CFO said the $0.24 decline was driven by "limited sales growth and lost manufacturing absorption related to the cyber incident, as well as tariffs and increased interest expense."5 Nothing on the record separates the incident's share.
In the second quarter, organic net sales rose 9.0%, and Stryker reported "significant progress in our recovery from the cyber incident."13
What is still not known about Stryker
How the intruder got in, and which account or tool was used.
Why production depended on the systems that went down. Stryker has not said; the dependency described below is BlastWave's analysis.
Who carried out the attack. Stryker names no actor, and the Justice Department statement concerns who made the claim.7
The incident's cost in dollars, and how much of the first quarter decline in adjusted EPS it accounts for, separate from tariffs and interest.5
How many devices were affected and whether any data left the company. No filing gives a device count or a data volume.
Whether any surgical procedure was delayed.
Claims about Stryker the record does not support
Widely repeated claim
What the record says
"Iran attacked Stryker."
Handala claimed it. The Justice Department says the MOIS used the Handala domain to claim credit for an attack on an unnamed firm. That is about the claim, not the deed.7,8
"The headline device counts and data volume are what Stryker lost."
None appears in any Stryker filing. The largest figures trace to Handala's claim as reported.8
"Stryker's devices were wiped through its device management system."
Stryker's filings describe a malicious file that ran commands and hid activity, not capable of spreading, and name no malware family or tool. CISA's endpoint management guidance is advice to all organizations, not Stryker's finding.3,12
"The attack cascaded into hospitals."
Stryker did not believe patient-related services were disrupted; the AHA was not aware of direct impacts to US hospitals. No regulator statement found.4,11
BlastWave analysis: the plant did not need to be reached
Analysis, not a disclosed fact
This is a teaching case for production stopping without a control system being touched. Everything on the record is corporate: a corporate network including its Microsoft environment, an identity directory, servers and workstations.3 Yet the company could not make product for almost three weeks, in its chief executive's words, and its finance chief tied lost margin to production shutdowns.5 On the consequence ladder that is an IT compromise halting physical operations, and nothing on the record supports a higher rung.
Why the plants stopped is not disclosed, and the silence is the useful part. BlastWave's reading, which is analysis and not a disclosed fact, is that a modern plant takes its orders, labels, lot records and shipping authority from the same corporate login everyone else uses. Remove that login and a line with nothing wrong with it has nothing it is allowed to build or send. The question Stryker leaves every manufacturer is not about detection. It is whether anyone built a way to make and ship product for a week without the corporate login.
Podcast: “The Blank Music Stands” (9:09). Joe Baxter and Cam Cullen on why a plant that nobody reached could still stand idle for almost three weeks.
Video: Stryker Short (60 to 90 seconds).
Frequently asked questions
What happened in the Stryker cyberattack?
On 11 March 2026 Stryker, the Michigan-based medical device maker, identified a cybersecurity incident in its corporate network and disclosed it to the SEC the same day. Its filings say order processing, manufacturing and shipping were disrupted. Its chief executive said on the 30 April earnings call that the company could not make product for almost three weeks. Stryker said on 9 April that it was fully operational across its global manufacturing network.
Were Stryker's factories or medical devices hacked?
Nothing on the public record says so. Stryker said on 12 March 2026 that it did not believe its connected products were impacted, and its filings describe only corporate systems: its Microsoft environment, Entra ID, servers and workstations. A full-text search of its 2025 to 2026 SEC filings finds no mention of operational technology or industrial control. That describes the record as of September 2026, not proof that no machine was touched.
Did Iran hack Stryker?
A persona called Handala claimed the attack on 11 March 2026. The Justice Department said on 19 March 2026 that Iran's Ministry of Intelligence and Security used the Handala domain to claim credit for a destructive malware attack on a US medical technologies firm, without naming Stryker. That statement is about who made the claim, not a finding about who carried out the attack. Stryker names no attacker in any filing.
How long was Stryker's production down?
Stryker's chief executive, Kevin Lobo, said on the 30 April 2026 earnings call, as transcribed by third parties, that the company could not make product for almost three weeks and was fully operational across its global manufacturing network as of the week of 1 April. Stryker's amended 8-K of 9 April 2026 also reported the manufacturing network fully operational.
How much did the Stryker cyberattack cost?
Stryker has disclosed no dollar cost. Its amended 8-K of 9 April 2026 said the incident had a material impact on operations, with resulting impact on first quarter results, but was not material to full-year guidance. First quarter adjusted EPS fell 8.5% to $2.60, a decline the CFO attributed to the incident together with tariffs and higher interest expense, without separating them.
Did the Stryker attack affect hospitals or surgeries?
No statement from Stryker or any regulator we found says so. Stryker said on 12 March 2026 that it did not believe its patient-related services were disrupted, and the American Hospital Association said the same day it was not aware of direct impacts to US hospitals. On the earnings call the chief executive said the company lost some cases when its representatives could not be present, which refers to lost business.
What malware was used in the Stryker attack?
Stryker has named none. On 11 March 2026 it reported no indication of ransomware or malware. On 23 March 2026 it corrected that, saying the actor used a malicious file to run commands that hid its activity, and that the file was not capable of spreading. No filing names a malware family or the tool used, and the device management product named in coverage appears in no Stryker filing.
Primary sources are Stryker's own SEC filings and exhibits, the Justice Department's release and CISA's alert. Earnings call wording comes from third-party transcripts, and press is cited only as evidence of what was said or claimed.
Company filingStryker Corporation, Form 8-K, Item 8.01, filed 11 March 2026 (accession 0001193125-26-102460): "global disruption to the Company's Microsoft environment"; "no indication of ransomware or malware." sec.gov
Company filingSEC EDGAR, Stryker Corporation company record (CIK 0000310764, SIC 3841, surgical and medical instruments) and full-text search of its filings, run 24 September 2026 and repeated 28 September 2026: "operational technology," 2025 to 2026, 0 results; "industrial control," 2025 to 2026, 0 results.
Company filingStryker Corporation, Form 8-K, Items 7.01 and 9.01, filed 23 March 2026 (accession 0001193125-26-118634), with Exhibit 99.1, Palo Alto Networks Unit 42, "Stryker Corporation Partner and Customer Connections to the Stryker Environment," dated 20 March 2026, and Exhibit 99.2, customer update dated 23 March 2026. sec.gov · Ex. 99.1 (Unit 42 letter)
Company filingStryker Corporation, Form 8-K, Item 7.01, filed 12 March 2026 (accession 0001193125-26-104431): update from Chief Information Security Officer Dave Nathans to customers. sec.gov
PressStryker first quarter 2026 earnings call, 30 April 2026, as transcribed by The Motley Fool and by Investing.com. Third-party transcripts, not a Stryker-published transcript; wording differs slightly between them. Cited as the record of what was said on the call. fool.com
Company filingStryker Corporation, Form 8-K/A (Amendment No. 1), Items 1.05 and 7.01, filed 9 April 2026 (accession 0001193125-26-149607). sec.gov
FederalUS Department of Justice, Office of Public Affairs, "Justice Department Disrupts Iranian Cyber Enabled Psychological Operations," 19 March 2026. justice.gov
PressTechCrunch, report of Handala's claim as posted and of a Stryker spokesperson's statement, 11 March 2026. Cited as evidence of what was claimed. techcrunch.com
Company filingStryker Corporation, Form 10-Q for the quarter ended 31 March 2026, filed 11 May 2026 (accession 0000310764-26-000031); the phrase "idle production time" also appears in the Form 10-Q for the second quarter, filed 31 July 2026. republished text
CompanyStryker Corporation, "Stryker reports first quarter 2026 operating results," 30 April 2026, furnished as Exhibit 99.1 to Form 8-K, Item 2.02 (accession 0000310764-26-000025). globenewswire.com
PressAmerican Hospital Association, AHA News, 12 March 2026, statement of John Riggi. Cited for the association's statement. aha.org
FederalCISA, "CISA Urges Endpoint Management System Hardening After Cyberattack Against US Organization," 18 March 2026. Read through republications (BleepingComputer and community.itbible.org); the text was not read on cisa.gov. republication
CompanyStryker Corporation, "Stryker reports second quarter 2026 operating results," 30 July 2026, furnished as Exhibit 99.1 to Form 8-K, Item 2.02. globenewswire.com
Cite this page
BlastWave. “Stryker Cybersecurity Incident (2026): What Is Verified.” Hackopedia, Volume 2, FILE 040. Last verified 28 September 2026. https://hackopedia.blastwave.com/manufacturing/stryker-2026/
Revision history
Date
Change
6 Oct 2026
Numbered FILE 040 in Hackopedia Volume 2, in the Manufacturing edition.
28 Sep 2026
Hand-check of SEC EDGAR full-text search confirmed that no Stryker filing from 2025 to 2026 uses the terms "operational technology" or "industrial control." Cross-entry consistency review.
26 Sep 2026
Full validation of every figure, date and quotation against Stryker's SEC filings and exhibits, the Justice Department release, CISA's alert and the earnings call transcripts. Scope and materiality wording aligned to the filings' own terms.
24 Sep 2026
Volume 2 entry built from primary sources.
How Hackopedia verifies an entry
Every figure, date and quotation traces to a court record, sworn testimony, a government or regulator document, the operator's own dated statements, a named researcher's published work, or a dated publication named as such. Where the record says less than the headlines, we print what the record says and mark the rest as reported or undisclosed. Pages are re-verified when new filings, rulings or official statements appear, and every change is logged. Why Hackopedia exists · How to read an entry
