Stryker Says Cyber Incident Disrupts Orders, Manufacturing and Shipping

Stryker said a cybersecurity incident that began on March 11 has disrupted its order processing, manufacturing and shipping, according to a Form 8-K the medical technology company furnished to the US Securities and Exchange Commission on March 12. The company said it does not believe its patient-related services were disrupted or that its connected products were affected.

In an earlier filing dated March 11, Stryker said it had identified an incident affecting certain information technology systems "that has resulted in a global disruption to the Company's Microsoft environment." The company said it activated its cybersecurity response plan, launched an investigation with external advisors and cybersecurity experts, and "has no indication of ransomware or malware and believes the incident is contained."

No timeline for full restoration

The March 11 filing said the incident has caused, and is expected to continue to cause, disruptions and limits on access to some of the company's information systems and business applications. "While the Company is working diligently to restore affected functions and systems access, the timeline for a full restoration is not yet known," Stryker said, adding that it has business continuity measures in place to keep supporting customers and partners.

The company said it had not yet determined whether the incident is reasonably likely to have a material impact, because the full scope, nature and impacts, including operational and financial impacts, were not yet known.

In the March 12 filing, Stryker said its chief information security officer, Dave Nathans, had briefed certain customers and members of the cybersecurity community that day on the ongoing incident. The investigation remains ongoing, the company said.

Claim of responsibility

A hacktivist group called Handala claimed responsibility, BleepingComputer reported on March 11. The outlet described the group as Iranian-linked and said it first surfaced in December 2023 as an operation linked to Iran's Ministry of Intelligence and Security. Handala said it extracted 50 terabytes of data and wiped more than 200,000 systems, servers and mobile devices, according to the report. Stryker has not confirmed those figures, and its filing said it had no indication of ransomware or malware.

People who said they were Stryker employees in the United States, Ireland, Costa Rica and Australia told BleepingComputer that managed Windows and mobile devices were remotely wiped overnight, and that some locations reverted to "pen and paper" workflows. BleepingComputer also reported that the company's Entra login page was defaced with a Handala logo.

Hospitals assess exposure

The American Hospital Association said it was exchanging information with hospitals and the federal government about the incident, AHA News reported on March 12. "At this time, we are not aware of any direct impacts or disruptions to U.S. hospitals as a result of this attack," said John Riggi, the AHA's national advisor for cybersecurity and risk. "That may change as hospitals evaluate services, technology and the supply chain related to Stryker and as the duration of the attack extends."

Stryker makes surgical and neurotechnology equipment, among other products, and has more than 53,000 employees, according to BleepingComputer. The company's filings did not say when it expects order processing, manufacturing and shipping to return to normal.