A cyberattack on global medical device technology company Stryker has drawn attention from health systems that rely on its products and services. According to reports cited by Healthcare IT News, the incident affected Stryker’s Microsoft environment and prompted some Michigan hospitals to take precautionary measures, including using backup communications and taking certain equipment offline.

The company said it has no indication of ransomware or malware and believes the incident is contained. Even so, the attack has raised broader concerns about how a single vendor compromise can affect multiple healthcare organizations at once.

What happened in the Stryker cyberattack

Stryker, based in Kalamazoo, Michigan, disclosed in a compliance report filed with the U.S. Securities and Exchange Commission on March 11 that the incident had caused, and was expected to continue to cause, disruptions and limitations of access to certain information systems and business applications that support parts of its operations and corporate functions.

Local reports also said Stryker asked employees at its Portage, Michigan, facility to stay off its network, avoid using computers, and remain off WiFi until systems could be restored. A sign on the facility door reportedly advised work-phone users to remove the Stryker Management profile.

According to a report by KrebsOnSecurity, the attack has been claimed by the pro-Iranian hacktivist group Handala. The source material says the group claimed responsibility in response to actions related to the Iran war. The report also states that the remote attack appears to have used Microsoft Intune’s unified, web-based administrative console to wipe devices connected to it. The threat actors allegedly erased data from more than 200,000 systems, servers and mobile devices.

Why health systems are paying attention

Because Stryker supports medical devices used by healthcare organizations, the incident has prompted concern about downstream effects. Michigan Department of Health and Human Services said some hospitals are taking precautions, according to a CBS News affiliate report. The source material does not identify which hospitals were affected or specify the exact devices involved.

Nick Andersen, acting director of the Cybersecurity and Infrastructure Security Agency, said the agency has opened an investigation and is working with public- and private-sector partners to uncover relevant information and provide technical assistance. He noted that this work is continuing despite the partial shutdown of the Department of Homeland Security.

No further healthcare sector-specific alerts or mitigation actions for medical devices, operating systems, or specific software had been provided at the time of the report.

Supply-chain risk and recommended precautions

Cybersecurity expert Dave Bailey, vice president of consulting at Clearwater Security, said healthcare security teams should treat the incident as a supply-chain cyber risk event. He said the danger of a single vendor compromise can cascade across hundreds of health systems.

Bailey recommended focusing on vendor access management, network segmentation for medical devices, and continuity planning for clinical technology services. He also outlined several practical steps healthcare entities can take while awaiting more information from Stryker and other authorities.

• Restrict or closely monitor connectivity between hospital networks and Stryker-managed systems, applications, or vendor support channels.
• Verify the operational status of medical devices and ensure fallback or downtime procedures are available.
• Review endpoint security controls for devices running Windows or mobile device management software tied to vendor environments.
• Monitor vendor communications and sector advisories for updates, patching requirements, or device-specific guidance.
• Maintain heightened vigilance for phishing, credential theft, or supply-chain compromise attempts that could use the disruption as cover.

The wider cybersecurity and policy context

The incident comes as federal officials continue to warn critical sectors about threats from pro-Iranian actors and the potential for destructive attacks. Sen. Gary Peters, D-Michigan, said the cyberattack signals real-world threats to communities and criticized federal cybersecurity funding cuts. He said the government has a duty to help communities defend against threats they face.

Stryker CEO Kevin Lobo also addressed employees in an open letter, saying the company plans for situations like this and that mitigation protocols were quickly activated to protect employees, sites, customers, and the patients they serve.

Conclusion

The root cause of the incident has not been fully confirmed in the source material, but the event has already triggered precautionary action and renewed attention on vendor-linked cyber risk in healthcare. For hospitals and health systems, the case underscores the importance of access controls, downtime planning, and close monitoring of third-party dependencies.