A hacktivist group with links to Iran’s intelligence agencies is claiming responsibility for a data-wiping attack against Stryker, a global medical technology company based in Michigan. News reports from Ireland, Stryker’s biggest base outside the US, indicate the company sent more than 5,000 employees home today. Meanwhile, a voicemail at Stryker’s main U.S. headquarters announces that the company is currently dealing with a building emergency. Headquartered in Kalamazoo, Michigan, Stryker (NYSE:SYK) is a medical and surgical equipment manufacturer that generated $25 billion in worldwide sales last year. In a long message shared on Telegram, the hacktivist collective Handala (also known as Handala Hack Team claimed that Stryker’s offices in 79 countries were forced to shut down after the group wiped data from over 200,000 systems, servers, and mobile devices. In a manifesto, the Iran-backed hacktivist collective Handala announced a large-scale data-wiping operation targeting medical technology firm Stryker. “All the acquired data is now in the hands of the free people of the world, ready to be used for the true advancement of humanity and the exposure of injustice and corruption,” the statement reads. The group said the wiper attack was retaliation for events in February. A missile strike that slammed into an Iranian school, killing at least 175 people, the majority of them children. The New York Times reported today that a continuing military probe has concluded the United States carried out the lethal Tomahawk missile strike. Handala was among a handful of hacking collectives recently examined by Palo Alto Networks, which connects the group to Iran’s Ministry of Intelligence and Security (MOIS). Palo Alto indicates that Handala first appeared in late 2023 and is believed to be one of multiple online personas operated by Void Manticore, an actor linked to Iran’s MOIS. According to Stryker’s website, the company employs 56,000 people across 61 countries.
Krebs on Security