INSIGHTS
Stryker, thousands of devices wiped: the destructive attack and war exclusions
On 11 March 2026 an attack claimed by the Iran-linked group Handala remotely wiped thousands of Stryker devices, disrupting orders, shipping and production for nearly a month. The analysis: destruction without ransom, the state and war exclusions, interruption in healthcare and questions for renewals.
Archive: reconstruction written in November 2026
Topic of the month, March 2026 · by cybercoverinsurance
On 11 March 2026 Stryker, one of the world's largest makers of medical devices and surgical equipment, found that thousands of company computers and phones had been remotely wiped overnight. The attackers did not use ransomware, but the tool the company used to manage its own devices. The group Handala, which researchers link to Iran's intelligence ministry, claimed the attack as retaliation for a US strike in Iran. Orders, shipping and production were disrupted for nearly a month.
For cyber underwriters the case brings together three themes: a destructive attack without ransom, attribution to a state in the context of armed conflict, and the interruption of a large manufacturer on which hospitals depend.
What is known
The attack. During the night of 11 March, devices enrolled in Stryker's mobile device management system, including Windows computers and personal phones used for work, were remotely wiped. The company login page was defaced with the Handala logo. In the Form 8-K filed the same day, Stryker spoke of a global disruption to its Microsoft environment, said it had no indication of ransomware or malware and had no timeline for full restoration. Some sites went back to pen and paper (BleepingComputer).
The claim. Handala said it had wiped more than 200,000 systems, servers and mobile devices and forced offices in 79 countries to close, presenting the attack as retaliation for the bombing of an Iranian school on 28 February. Stryker sent more than 5,000 workers home in Ireland. A doctor at a US university hospital said they could not order surgical supplies normally, while the American Hospital Association knew of no disruption to hospital supplies. The company has about 56,000 employees and 25 billion dollars in annual sales (KrebsOnSecurity).
The impact. On 9 April Stryker told the SEC that the attack had had a material impact on first-quarter results, but not on the full year. Orders and shipping had been disrupted and production temporarily stopped; in the UK the National Health Service had set up an interim ordering system (Cybersecurity Dive). In the first quarter revenue grew 2.6% to 6.02 billion dollars, against 6.33 billion expected by analysts, and the chief executive said growth had been "meaningfully impacted" by the incident (MassDevice).
The tail. At the end of July Stryker was still working through its order backlog, especially for hospital beds, and expected to bring it to a manageable level by the end of the third quarter. The chief executive noted that production had been down "for a long period of time" (MedTech Dive). At least six lawsuits were filed by employees over failure to protect their personal data (Paubox).
What is not known. The total cost of the attack, whether there was insurance cover, how the attackers obtained privileges on the management tool and the real number of wiped devices have not been made public. Stryker has not attributed the attack.
Destroying without asking for anything
No ransom, no negotiation. A destructive attack leaves no option to pay to get the data back. The loss lies entirely in recovery and interruption. For underwriters, the scenario must be estimated without counting on a decryption key or a negotiation that shortens the timeline.
The management tool as a weapon. The devices were wiped with the tool the company used to administer them (BleepingComputer). Whoever obtains admin privileges on that system can hit tens of thousands of devices with one command. It is a control the questionnaire rarely examines.
Personal devices enter the loss. Personal phones enrolled for email access were also wiped (KrebsOnSecurity). Damage to employees' property, and the related lawsuits, widen the claim beyond company systems.
The state, war and exclusions
An attack inside a conflict. Handala presented the attack as retaliation for a US military action (KrebsOnSecurity). The link with Iran's intelligence ministry comes from researchers, not from a government. Stryker has not attributed the attack.
War exclusions put to the test. War and state-attack exclusions introduced in recent years often look at attribution by a government and the effect on a state's security. An attack on a private company, claimed by a front group and attributed only by researchers, sits in a grey zone. The wording must say how a claim that explicitly speaks of military retaliation is treated.
The target does not choose the conflict. Stryker was hit as a large US company, not because of its business. In a conflict with a cyber component, risk shifts to visible companies of a country involved, regardless of sector.
Interruption in a critical sector
A month of disrupted production. Orders, shipping and production were disrupted for nearly a month (MedTech Dive). First-quarter growth was hit and backlogs were still dragging on in July. The indemnity period must cover the recovery of orders, not just the return of systems.
Hospitals as dependent customers. The British health service had to set up an interim ordering system (Cybersecurity Dive). For healthcare providers, dependence on a large device supplier is a customer-to-supplier dependency that the hospital's cyber policy usually does not cover if the supplier is not an IT service.
Liability towards customers. A medical device maker that fails to deliver can face claims from customers. Contracts usually limit this liability, but in healthcare the pressure is higher.
What to bring to renewals
Impact for insurersHigh
A destructive attack claimed by an Iran-linked group remotely wiped thousands of devices at a large medical device maker, disrupting orders, shipping and production for nearly a month.
On the portfolio side, the Stryker case suggests treating geopolitical risk as an aggregation factor: in a conflict with a cyber component, large visible companies of a country involved can be hit together, by destructive attacks that leave no room for negotiation. It is a scenario to test together with the wording of exclusions.