By now most of you have probably heard about the Stryker cyberattack. We’ve been watching it closely — and like a lot of you, we’ve had our hands full fielding questions from clinical staff, checking in on connected devices, and trying to separate what we actually know from the noise swirling around on social media.

So, here’s a straightforward breakdown of what happened, what it means for those of us in HTM and Biomed, and — more importantly — how to use this as a genuine opportunity to stress-test your program.

What Happened

On March 11, 2026, Stryker was hit by a significant cyberattack. A pro-Iran hacking group called Handala claimed responsibility, saying they wiped over 200,000 devices and exfiltrated 50TB of data. Stryker filed an 8-K with the SEC confirming a “cybersecurity incident” affecting their Microsoft environment.

The attack appears to have used Microsoft Intune — Stryker’s own device management platform — to push a remote wipe command across their global fleet of phones, laptops, and workstations. Think about that for a second: the tool designed to manage and secure their devices was turned into the weapon.

Stryker has been consistent in saying their connected products were not affected — the incident was contained to their internal enterprise environment. You can read their official customer update here, and their SEC 8-K filing here.

LIFENET and the Clinical Impact

One of the more unsettling early moments was around LIFENET — Stryker’s platform for pre-hospital 12-lead ECG transmission. On March 11, Maryland’s EMS authority sent out a statewide notice that LIFENET was “non-functional in most parts of the state.” Hospitals were told to revert to radio consultation for incoming STEMI patients.

Stryker later confirmed LIFENET was actually fine and hadn’t been disrupted by the incident. But the damage was already done — hospitals didn’t know that in the moment, and several proactively pulled the plug on Stryker connections as a precaution anyway.

This is a really important lesson for our teams. The secondary effects of a vendor cyber incident — the uncertainty, the precautionary disconnections, the workarounds clinical staff improvise on the fly — can create real operational and patient care impact even when the devices themselves are completely uncompromised.

Does your team know the difference between a disruption to a vendor’s back-end systems and an actual compromise of the device sitting at the bedside? Does your clinical leadership? That gap is where the chaos lives.

Some of the Observed Impacts — In No Particular Order

• LIFENET disruption uncertainty caused hospitals to suspend connections and revert to radio protocols, even where no actual device issue existed.
• Stryker order and supply chain systems went down, affecting hospitals that depend on Stryker implants and instruments for scheduled surgical cases.
• Vendor communication delays in the first hours left clinical engineering teams trying to make device-use decisions without enough information.
• No clear playbook for “vendor enterprise attack” scenarios — most downtime procedures are built around internal IT failures or ransomware, not third-party vendor disruptions.
• Geopolitical escalation as a threat vector — this wasn’t a financial crime. It was targeted disruption. That’s a different risk model than most of our departments have planned for.

The Opportunity

Now is actually a really good time to take stock of your program and look for the gaps this kind of incident exposes. A few things worth asking your team:

• Do you have a current inventory of which Stryker (and other vendor) products in your facility connect to external platforms, cloud services, or vendor-managed infrastructure?
• Do you have downtime procedures for LIFENET and other vendor-managed clinical platforms — and when did you last test them?
• If a vendor tells you their systems are “contained” and devices are safe, do you have the network visibility to verify that independently?
• Do you have a contact list and escalation path specifically for vendor cyber incidents — separate from your regular service contact?
• Has this incident landed on your leadership’s radar? It’s a good moment to have that conversation about vendor cyber risk and what it means for clinical operations.

We’ve gathered some useful resources below. And as always, we’d love to hear how your team handled it — what worked, what didn’t, and what you’re changing as a result. Feel free to reach out or leave a comment.

Resources

Stryker Customer Update — March 2026

Stryker SEC 8-K Filing

Krebs on Security — Iran-Backed Hackers Claim Wiper Attack on Stryker

Cybersecurity Dive — Stryker Attack Raises Concerns About Microsoft Intune Abuse

AHA — Medical Technology Company Stryker Disrupted Globally by Cyberattack

SecurityWeek — MedTech Giant Stryker Crippled by Iran-Linked Hack

Alliant — What Healthcare Organizations Need to Know

Feel free to Reach Out!!