Stryker cyberattack (March 2026): what Stryker confirmed and what Handala claims
In March 2026 the medical-technology company Stryker disclosed a cyberattack that took down its Microsoft environment worldwide and disrupted orders, manufacturing and shipping. This page sets out what Stryker filed, what the attackers claim, and what security certifications Stryker publicly held.
Short answer
Was Stryker hacked?
Yes. Stryker said in a Form 8-K that it identified a cybersecurity incident on 11 March 2026 that caused a global disruption to its Microsoft environment, and later filings said order processing, manufacturing and shipping were disrupted. Stryker says the attack was contained to its internal Microsoft environment and did not affect its products.
The pro-Iran persona Handala claimed it wiped more than 200,000 devices and took 50 TB of data. Stryker has not confirmed those figures. Bloomberg reported Stryker shares fell 3.6% on the day of the disclosure.
Timeline at a glance
11 Mar 2026Stryker identifies an incident disrupting its Microsoft environment worldwide (8-K). (BleepingComputer)Confirmed
11 Mar 2026Shares fall 3.6% to $345.78. (Bloomberg)Reported
Mar 2026Handala claims 200,000+ devices wiped and 50 TB taken. (BleepingComputer)Unverified claim
Last updated October 31, 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.
Stryker’s security posture at the time
What Stryker publicly said about its security certifications and controls, how big it is, and how its shares moved, each tied to a source. A certificate covers a stated scope at a point in time; it is not a guarantee about every system. Reviewed 31 October 2026. Compare all 2026 breaches.
Security certifications publicly held
No public certification found.
No organisation-level certification found. Stryker’s security page lists credentials held by its security staff (including two ISO 27001 credentials), which are personal qualifications, not a company certificate. A security overview for Vocera, a Stryker company, says ISO 27001 and SOC 2 Type 2 “may apply” to some of its solutions. trust.stryker.com said external access was not yet available when checked.
Confirmed = acknowledged by Stryker, a regulator filing or a court. Reported = credible reporting Stryker has not fully confirmed. Unverified claim = an attacker or leak-site claim.
11 Mar 2026ConfirmedDestructive attack / operations
Wiper-style attack disrupts Stryker’s Microsoft environment and operations
What happened. Stryker said in a Form 8-K that it identified a cybersecurity incident on 11 March 2026 that caused a global disruption to its Microsoft environment, later disrupting order processing, manufacturing and shipping. The pro-Iran persona Handala claimed it wiped more than 200,000 devices and took 50 TB; Stryker has not confirmed those figures.
Impact. Orders, manufacturing and shipping were disrupted, per Stryker’s filings. People or records affected: No personal-data count disclosed; Stryker says the attack was contained to its internal Microsoft environment and did not affect its products.
Handala’s device and data figures are its own claims; Stryker has not confirmed them.
The pattern across the record
Certified, and still breached?
We found no SOC 2 or ISO 27001 certification published by Stryker. That does not prove it had none; it means none was public.
Operations, not only data
The visible impact was operational disruption. Resilience controls (segmentation, tested restore, the ability to run production while IT is down) decide how long that lasts, and they are only partly covered by a typical SOC 2 or ISO 27001 scope.
What it means for Stryker hospitals, distributors and partners who depend on Stryker — and what to do
What Stryker’s customers, partners and security teams can do now, based only on what has been disclosed.
1.Plan for the supplier being down
If you depend on this company’s products or services, check stock, alternative suppliers and how long you can operate without them.
2.Ask for restoration status and indicators
Request the supplier’s restoration timeline and any indicators of compromise you should hunt for in shared connections.
Yes. Stryker said in a Form 8-K that it identified a cybersecurity incident on 11 March 2026 that caused a global disruption to its Microsoft environment, and later filings said order processing, manufacturing and shipping were disrupted. Stryker says the attack was contained to its internal Microsoft environment and did not affect its products.
Did Stryker have SOC 2 or ISO 27001 certification?+
We found no SOC 2 or ISO 27001 certification published by Stryker. That does not prove it had none; it means none was public.
More in the Breach Index
Same sourced, verification-tagged timeline, company by company — compare how peers have fared.
Independent analysis for security-leadership education; not affiliated with or endorsed by Stryker. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.
🎉 New here? Use code WELCOME10 for 10% off any plan at checkout