Stryker hacked, 50 Terabytes gone: How a US strike on a school in Iran set off a global cyberattack
The group Handala, with documented ties to Tehran, claims to have seized 50 terabytes of sensitive data from the Michigan-based medical devices company — and warns that this is only the beginning.
One of the world's largest medical device manufacturers has become the latest and most consequential target in what Iranian-linked cyber operatives are calling an escalating campaign against Western economic infrastructure. Stryker Corporation, a Michigan-based firm whose products reach more than 150 million patients annually across 61 countries, confirmed on Wednesday that it was “experiencing a global network disruption to our Microsoft environment as a result of a cyberattack.”
The incident knocked out Windows-based laptops and mobile phones connected to its systems beginning shortly after midnight on the US East Coast.
Calls to the company's headquarters in Portage, Michigan, were met with a recorded message saying the company was dealing with “a building emergency”, reported Al Jazeera.
Who Is Behind the Cyber Attack on Stryker - and Why
Handala, a hacking persona with documented ties to Tehran, has claimed responsibility for the major cyberattack on Stryker. In a statement, it said the attack was carried out in direct retaliation for a strike on a school in Minab, a city in southern Iran. The group said that more than 170 people, the majority of them schoolgirls, were killed on the first day of the US-Israeli military campaign against Iran.
Handala framed the attack as proportionate retribution. It declared that the stolen data was "now in the hands of the free people of the world."
The group described the incident as “the beginning of a new chapter in cyber warfare.”
The school strike has drawn international scrutiny. Al Jazeera's Digital Investigations Unit, using satellite imagery analysis, reported that the site may have been deliberately targeted.
Six senior Democratic senators in the United States have also called for a formal investigation, saying in a joint declaration that they were "horrified" by the incident.
Scale of the Iranian Breach
Handala claims to have exfiltrated 50 terabytes of Stryker's corporate data.
Stryker reported revenues exceeding $25 billion in 2025. It manufactures everything from artificial joints and robotic surgery systems to hospital beds and surgical instruments. The company said it found no evidence of ransomware or malware and believed the incident to be contained.
Company staff, however, said that Handala's logo had appeared on company login pages, a visible marker of the intrusion.
The FBI and the Department of Homeland Security's cybersecurity agency did not respond to requests for comment.
Handala simultaneously claimed an attack on payments company Verifone, which denied experiencing any service disruption.
A Broader Iranian Cyber Offensive
The Stryker attack does not appear to be an isolated incident. Iran's Islamic Revolutionary Guard Corps (IRGC) this week issued warnings designating US and Israeli-linked "economic centres and banks" across the region as legitimate targets.
State-affiliated Iranian media published a list of prominent US technology firms, among them Google, Microsoft, and Nvidia, characterising their regional infrastructure as “Iran's new targets.”
An Iranian security source, speaking to Al Jazeera's Tohid Asadi, suggested the conflict was entering "a new phase." He hinted that a key regional waterway could face restrictions akin to those previously threatened by Tehran regarding the Strait of Hormuz — though declining to provide further details.
About the Author
Sayantani Biswas is an assistant editor at Livemint with seven years of experience covering geopolitics, foreign policy, international relations and global power dynamics. She reports on Indian and international politics, including elections worldwide, and specialises in historically grounded analysis of contemporary conflicts and state decisions. She joined Mint in 2021, after covering politics at publications including The Telegraph. <br> She holds an MPhil in Comparative Literature from Jadavpur University (2019), with a specialisation in postcolonial Latin American literature. Her research examined economic nationalism through Eduardo Galeano’s Open Veins of Latin America. She also writes on political language, cultural memory and the long shadows of conflict. <br> Biswas grew up in Durgapur, an industrial town in West Bengal shaped by migration, which drew families from across India to the Durgapur Steel Plant. As the only child in a joint family, she spent years listening—almost obsessively—to her grandparents’ testimonies of struggle, fear and loss as they fled Bangladesh during the Partition of 1947. This formative exposure to lived historical memory later converged with her training in Comparative Literature, equipping her to analyse socio-economic structures and their reverberations. <br> Outside the newsroom, she gravitates towards cultural history and critical theory, returning often to texts such as Paulo Freire’s Pedagogy of the Oppressed. As a journalist, she is committed to accuracy, intellectual rigour and fairness, and believes political reporting demands not only clarity and speed, but historical depth, contextual precision, and a disciplined resistance to spectacle.