Iran‑Linked Hacktivist Handala Claims Deletion of 12 PB and Theft of 50 TB from MedTech Giant Stryker; Incident Contained
What Happened – On 11 March 2026, Stryker disclosed that a malicious file was used to gain limited access to its Entra ID, servers and workstations. The Iranian‑aligned hacktivist group Handala publicly claimed to have erased more than 12 petabytes and exfiltrated roughly 50 terabytes of data, though Stryker’s investigation (Palo Alto Networks Unit 42) found no evidence of ransomware, lateral spread, or impact on customers, suppliers or partners. The breach has been contained and Stryker is restoring systems from pre‑compromise backups.
Why It Matters for TPRM
- A nation‑state‑linked actor targeted a critical medical‑device supplier, highlighting supply‑chain exposure for healthcare providers.
- Claims of massive data loss (12 PB) raise concerns about the integrity of design, IP, and patient‑related information stored by Stryker.
- Containment relies on third‑party recovery services (Microsoft, Palo Alto) – TPRM teams must verify those partners’ security controls.
Who Is Affected – Healthcare & medical‑technology manufacturers; downstream hospitals, clinics, and device‑integrators that rely on Stryker’s platforms and services.
Recommended Actions
- Review Stryker’s security posture and incident‑response reports; request evidence of containment and backup integrity.
- Validate the security controls of third‑party recovery partners (Microsoft Entra ID, Palo Alto Networks).
- Re‑assess data‑handling agreements and ensure encryption and segmentation of any Stryker‑provided data in your environment.
- Monitor for any anomalous activity that could indicate residual compromise or credential misuse.
Technical Notes – The attacker employed a malicious file that executed commands to hide activity; no ransomware payload or worm‑like propagation was observed. No public CVE was cited. Affected assets included Azure Entra ID identity services, on‑premise servers, and workstations. Stolen data reportedly spanned design files, internal communications, and potentially patient‑related records. Source: DataBreachToday