On March 11, 2026, an Iran-linked hacktivist group called Handala launched a coordinated wiper attack against Stryker Corporation — one of the world's largest medical device manufacturers, with $25 billion in annual revenue and operations in 79 countries.
The attack did not use malware. It did not exploit a zero-day vulnerability. It did not involve ransomware.
The attackers compromised a single Microsoft Intune Global Administrator account and used it to issue a remote wipe command to every managed device in Stryker's environment. Within minutes, over 200,000 systems — Windows servers, PCs, laptops, mobile phones — were wiped clean.
This is not a story about Stryker's security posture. This is a story about what third-party risk actually looks like when it shows up at your door.
What Happened
At approximately 3:30 AM EDT on March 11, the Handala group — assessed by Palo Alto Networks as an online persona maintained by Void Manticore, an actor affiliated with Iran's Ministry of Intelligence and Security (MOIS) — used Global Administrator-level access within Stryker's Microsoft environment to trigger mass device wipes via Microsoft Intune.
Intune is a cloud-based endpoint management platform used by IT teams to enforce security policies, deploy software, and manage devices remotely. It is trusted infrastructure. And it was turned into a weapon.
The attack reportedly impacted operations across all 79 countries where Stryker operates. In Ireland alone — Stryker's largest hub outside the United States — approximately 5,500 employees were sent home as internal networks went offline.
Stryker confirmed that the attack disrupted order processing, manufacturing, and shipping. The group claimed to have exfiltrated approximately 50 terabytes of data, potentially including design files, supplier contracts, hospital records, and enterprise resource planning data.
Why This Matters for Healthcare Organizations
Stryker manufactures surgical instruments, orthopedic implants, hospital beds, and connected medical devices used in operating rooms across the country. When Stryker's operations stop, the downstream impact flows directly to hospitals and surgery centers.
This is the reality of third-party risk in healthcare: you can have a mature security program, a fully deployed SOC, and a comprehensive incident response plan — and still face operational disruption because a vendor you depend on was compromised.
The American Hospital Association confirmed it was actively monitoring the situation and exchanging information with federal authorities. While no direct disruptions to patient care were confirmed in the immediate aftermath, the potential for supply chain impact — delayed shipments of surgical instruments, implants, or replacement parts — was real and material.
The Third-Party Risk Lesson
Most healthcare organizations evaluate vendor risk through security questionnaires, SOC 2 reports, and contractual requirements. These are necessary but fundamentally insufficient.
Here is what the Stryker incident exposes:
Your Vendor's Internal Tooling Is a Risk Surface
Microsoft Intune is not an obscure product. It is the endpoint management platform used by over 72 percent of hospitals with more than 500 beds. It is trusted infrastructure — and that trust is exactly what made it effective as an attack vector.
The attackers did not need to deploy malware. They did not need to move laterally through networks. They used a legitimate management tool to issue a legitimate command — remote wipe — at a scale that was devastating.
If your vendor risk assessments do not ask how your vendors manage privileged access to their own endpoint management platforms, they have a gap.
Security Questionnaires Do Not Capture This Risk
A standard vendor security questionnaire would not have revealed the specific vulnerability that Stryker experienced. The question "Do you use multi-factor authentication?" does not capture whether MFA is enforced on every Global Administrator account in a vendor's Microsoft tenant. The question "Do you have an endpoint management solution?" does not capture whether that solution has been hardened against administrative account compromise.
Vendor risk management needs to evolve beyond checkbox compliance and into scenario-based assessment: what happens if your endpoint management platform is compromised? What happens if a Global Administrator account is taken over? What are the blast radius controls?
The Impact Is Operational, Not Just Data
When healthcare leaders think about vendor breaches, they often think about data — PHI exposure, notification requirements, regulatory consequences. The Stryker incident is a reminder that operational disruption can be the primary impact.
If your surgical instrument vendor cannot ship products, your operating rooms are affected. If your implant manufacturer goes offline, your scheduled procedures are at risk. The financial and patient care implications of operational disruption can exceed the cost of a data breach.
You Cannot Outsource Accountability
Healthcare organizations are accountable for patient care regardless of what happens to their vendors. When HIPAA enforcement actions follow a breach, "our vendor was compromised" is not a defense.
This means your vendor risk program must include:
Business continuity planning for vendor disruption. What is your plan if a critical vendor goes offline for days or weeks? Do you have alternative suppliers identified? Can you maintain clinical operations?
Vendor incident notification requirements. How quickly will your vendor notify you of a security incident? Is this contractually defined? The HIPAA Security Rule proposed changes include expanded requirements for business associate notification.
Ongoing monitoring, not point-in-time assessment. A SOC 2 report tells you what a vendor's security posture looked like during the audit period. It does not tell you what happened yesterday. Consider threat intelligence monitoring for your critical vendors.
What Healthcare Leaders Should Do Now
1. Identify Your Critical Vendor Dependencies
Not all vendors carry equal risk. Map the vendors whose disruption would directly impact clinical operations, patient care, or revenue. Stryker is an obvious one for surgical environments, but every organization has its own critical dependency list.
2. Evaluate Privileged Access Controls at Key Vendors
Ask your critical vendors specifically about their privileged access management for cloud administration. How are Global Administrator accounts protected? Is MFA enforced? Are there break-glass procedures? How are administrative actions audited?
3. Build Vendor Disruption Into Your Incident Response and Business Continuity Plans
Most incident response plans focus on what happens when your organization is compromised. Add a scenario for when a critical vendor is compromised. Who gets notified internally? What clinical operations are affected? What is the communication plan for affected departments?
4. Review Your Contractual Protections
Do your vendor agreements include specific incident notification timelines? Do they require the vendor to provide you with forensic information relevant to your environment? Do they address operational disruption, not just data breaches?
5. Monitor the Threat Landscape for Your Vendors
If a threat actor claims a breach at one of your critical vendors, you need to know about it before it shows up in the news cycle. Threat intelligence monitoring — whether through a service, an ISAC, or a curated intelligence feed — can provide early warning.
The Bottom Line
The Stryker breach is the clearest demonstration in recent memory that third-party risk in healthcare is not a compliance exercise — it is an operational reality. An Iran-linked group used a stolen credential and a legitimate Microsoft tool to disrupt one of the world's largest medical device manufacturers across 79 countries.
Every healthcare organization that depends on a vendor — which is every healthcare organization — should treat this as a planning scenario, not a news story.
The question is not whether one of your vendors will be compromised. The question is whether you will be ready when it happens.
Jackal Group helps healthcare organizations build vendor risk management programs that go beyond questionnaires. Contact us to discuss your third-party risk posture.