Iran-linked hackers claiming affiliation with the group Handala launched a cyberattack on Wednesday that disrupted technology operations at U.S.-based medical device maker Stryker, leaving employees around the world unable to access corporate systems, according to WOOD-TV, a NewsNation affiliate.
Impact On Operations
Employees reported seeing a message attributed to Handala in their web browsers. Many were instructed not to log into workstations or connect Stryker mobile apps while the company investigated. Staffers also reported that remote Windows devices — including laptops and mobile phones that had been connected to Stryker systems — appeared to have been wiped, WOOD-TV said.
Company Response
A company notice to employees said:
"We are experiencing a severe, global disruption impacting all Stryker laptops and systems that connect to our network."
A Stryker spokesperson told The Wall Street Journal the company was working to restore systems and that business continuity measures were in place. "Our teams are actively working to restore systems and operations as quickly as possible. We’re committed to continuing to serve our customers," the spokesperson said.
Attribution And Official Reaction
The group Handala claimed responsibility on social media, saying the strike was retaliation "for the brutal attack on the Minab school and in response to ongoing cyber assaults against the infrastructure of the Axis of Resistance," per WOOD-TV. A social-media post by Kash Patel said the FBI is "working 24/7 to stay ahead of the threat" and implementing an expanded cyber strategy to impose costs on actors who target Americans in cyberspace.
Context: Iran's Evolving Cyber Capabilities
Researchers and analysts say Iran has stepped up investment in cyber operations since the 2010 Stuxnet campaign that damaged parts of its nuclear program. Over the past decade Tehran's activity has reportedly shifted from espionage and influence work toward more disruptive attacks, including the 2012 Shamoon malware attack on Saudi Aramco and strikes against banks and infrastructure.
A Georgetown Security Studies Review report noted that Iran's cyber strategy has grown more aligned with its military objectives, particularly since the outbreak of the Israel-Hamas war, and that Iran has developed cyber units inside the Islamic Revolutionary Guard Corps and the Ministry of Intelligence and Security while also working with proxy hacker groups.
Regional Tension And Ongoing Developments
Wednesday’s Stryker incident follows a period of intense regional activity: U.S. and Israeli forces have carried out strikes on Iranian targets, and U.S. Central Command has publicly described a campaign it calls "Operation Epic Fury." Officials in several Gulf states reported retaliatory strikes attributed to Iran in the days before the Stryker outage. These developments appear to form part of a larger, escalating cycle of cyber and kinetic actions across the region.
What We Know: Handala claimed responsibility; Stryker has activated contingency plans and is restoring systems; employees reported wiped Windows devices; federal and company investigations are underway. This is a developing story; updates will follow as authorities and Stryker provide more details.
