CISA urges firms to harden endpoint systems following Stryker breach linked
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has urgently advised organizations to secure their Microsoft Intune management tools after a cyberattack on medical giant Sstryer exploited these same controls, resulting in the mass-wiping of thousands of employee devices by actors linked to Iran-backed groups. CISA emphasized that this incident serves as an early warning sign for U.S., European, and Middle Eastern entities regarding foreign state-sponsored activity spilling into critical infrastructure operations following recent conflicts abroad.
Key Points
-
1The U.S. cybersecurity agency CISA has issued urgent warnings to companies following the hack of Stryker, urging immediate action.
-
2Hackers linked pro-Iran activities breached medical tech giant Stryker and mass-wiped thousands of employee devices via endpoint management systems.
-
3CISA advises organizations in affected sectors (including healthcare) to secure their Microsoft Intune administrative controls immediately based on new guidance from the vendor.
Developments
Pro-Iran hacktivists known as Handala breached medical device maker Stryker and remotely wiped thousands of employee devices without deploying malware or ransomware following a retaliatory strike on Iran. CISA warned companies to secure their endpoint management systems by requiring dual-administrator approval for sensitive actions like data deletion, noting that while the attack has been contained at Stryker, its supply chain remains offline with no recovery timeline provided yet.
CISA warns that foreign cyber actors linked to Middle East conflicts are targeting U.S., specifically Stryker Corporation's internal Microsoft environment by exploiting endpoint management systems for data theft; in response, CISA urges organizations to secure their endpoints using best practices such as least privilege access and phishing-resistant MFA.
Following the recent cybersecurity attack against medical equipment manufacturer Striker. CISA has advised US companies to strengthen their Microsoft Intune accounts by implementing specific security recommendations outlined in a new advisory issued on Monday, March 18th (Margi Murphy/Bloomberg). The guidance aims to prevent similar breaches of corporate data and systems across various industries including healthcare
The US government's Cybersecurity and Infrastructure Security Agency has issued an urgent advisory urging organizations to harden Microsoft Intune following a cyberattack on Stryker Corporation by Iran-linked hackers. The attack, which disrupted services for over five days in March 2026, prompted CISA recommendations including least privilege access controls, phishing-resistant multi-factor authentication via Entra ID, and mandatory dual-administrator approval policies.