Pro-Palestinian hacktivist group Handala targets Stryker in global disruption

Pro-Palestinian hacktivist group Handala claims a cyberattack on Stryker, alleging it wiped 200,000 systems and disrupted global operations.

Pro-Palestinian hacktivist group Handala claims responsibility for a disruptive cyberattack against medical technology firm Stryker.

“Medical technology giant Stryker is experiencing a global outage across its systems after a cyberattack early Wednesday. Staff and contractors report that the logo of an Iran-linked hacking group has appeared on login pages.” reported The Wall Street Journal.

The group claims it wiped more than 200,000 servers, mobile devices, and other systems, forcing the company to shut down offices across 79 countries. The hacktivists also claim they exfiltrated about 50TB of corporate data from the company’s infrastructure.

Handala appears as a pro-Palestinian hacktivist group but is widely seen as a front for Iran-backed Void Manticore, as reported by SecurityWeek. Known for phishing, data theft, extortion, and destructive wiper attacks, they also engage in info operations and psychological warfare. Since the Iran conflict began, they’ve targeted Israeli military servers, intelligence officers, and companies, stealing or wiping data.

Stryker Corporation is a leading U.S.-based medical technology company that develops and manufactures devices and equipment used in hospitals, including surgical tools, orthopedic implants, medical imaging systems, and hospital beds. It is one of the world’s largest medical device manufacturers. Stryker reported global sales of $22.6 billion in 2024 and has over 53,000 employees.

“We announce to the world that, in retaliation for the brutal attack on the Minab school and in response to ongoing cyber assaults against the infrastructure of the Axis of Resistance, our major cyber operation has been executed with complete success.

The Zionist-rooted corporation, Stryker, one of the key arms of the global Zionist lobby and a central ring in the ‘New Epstein’ chain, has been struck with an unprecedented blow. In this operation, over 200,000 systems, servers, and mobile devices have been wiped and 50 terabytes of critical data have been extracted.” Handala wrote on its website. 

“Stryker’s offices in 79 countries have been forced to shut down. All the acquired data is now in the hands of the free people of the world, ready to be used for the true advancement of humanity and the exposure of injustice and corruption.”

The group said that this attack “is only the beginning of a new chapter in cyber warfare.”

Reports from Stryker employees in many countries, including the U.S., Ireland, and Australia, confirm devices were remotely wiped overnight.

“We are experiencing a severe, global disruption impacting all Stryker laptops and systems that connect to our network,” reads a message sent to staff based in Cork that Irish Mirror reported.

“At this time, the root cause has not yet been identified. We are actively engaged with Microsoft and treating this a critical, enterprise-wide incident.” reads a separate update sent to employees in Asia.

The company’s Entra login page was defaced with the Handala logo. Personal devices enrolled for work access also lost data, staff had to remove corporate apps, and many internal services went down.

Stryker is now restoring systems amid a global outage.

The stock of the Medical technology giant dropped after the cyberattack-

“Shares of Stryker retreated after the medical technology company was hit by a cyberattack.” reads The Wall Street Journal. “The stock was down 3.2% in Wednesday afternoon trading. Stryker said that the early morning attack produced a global network disruption to its Microsoft environment, affecting both client devices and servers.”

Several governments have historically leveraged hacktivist groups during conflicts or geopolitical tensions, often to achieve strategic goals while maintaining plausible deniability. These groups provide states with a way to conduct cyber operations without directly attributing attacks to official state agencies.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Stryker)