One of the most alarming cyber incidents of 2026 wasn’t caused by ransomware or a sophisticated piece of malware. Instead, attackers turned a company’s own management tools against it.On March 11, medical technology giant Stryker suffered a massive cyberattack that affected more than 200,000 employee devices across 79 countries. According to reports, the threat group Handala gained access to Microsoft’s Intune device management platform and used it to remotely factory reset company devices on a global scale.The impact was immediate and widespread. Employees suddenly lost access to their systems, disrupting operations across multiple regions. As a leading manufacturer of medical equipment, Stryker plays a critical role in healthcare systems worldwide. Its products are used in hospitals, emergency response services, and surgical facilities.
The attack reportedly affected healthcare operations as well. In Maryland, emergency medical personnel temporarily lost the ability to transmit ECG data to hospitals, highlighting how cyber incidents can quickly move beyond the digital world and affect patient care.
Handala claimed responsibility for the attack and stated that it had stolen approximately 50 terabytes of data. The group described the operation as retaliation for recent geopolitical tensions involving Iran, Israel, and the United States. U.S. authorities later linked Handala to Iran’s Ministry of Intelligence, elevating the incident from a criminal cyberattack to a state-sponsored operation.
Although law enforcement agencies seized several of the group’s websites, Handala quickly re-established its online presence through alternative channels and continued communicating through Telegram.
The incident also had financial consequences. Stryker’s share price fell nearly 4% following news of the attack, while the U.S. State Department announced a reward of up to $10 million for information leading to the identification of those responsible.
What makes this attack particularly significant is that no malware was deployed. No ransomware encrypted files. Instead, attackers abused legitimate cloud management tools that organizations rely on every day. The event serves as a reminder that modern cyber threats are not always about breaking security controls they are often about taking control of trusted systems and using them in unexpected ways.For security teams around the world, the message is clear: protecting administrative accounts and cloud management platforms is now just as important as defending against traditional malware.<\/p>\n","protected":false},"excerpt":{"rendered":"
One of the most alarming cyber incidents of 2026 wasn’t caused by ransomware or a sophisticated piece of malware. Instead, attackers turned a company’s own management tools against it.On March 11, medical technology giant Stryker suffered a massive cyberattack that affected more than 200,000 employee devices across 79 countries. According to reports, the threat group Handala gained access to Microsoft’s [\u2026]<\/span><\/p>\n","protected":false},"author":1,"featured_media":8921,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[226,220,225,6,10,5],"tags":[],"class_list":["post-9124","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-finance-and-legal","category-government-advisory","category-heavy-industry","category-latest_news","category-latest_vulnerabilities","category-ce_listen"],"acf":[],"jetpack_featured_media_url":"https:\/\/i0.wp.com\/cyberenso.jp\/wp-content\/uploads\/2025\/09\/cybersecurity-concept-illustration-1-scaled.jpg?fit=1752%2C2560&ssl=1","_links":{"self":[{"href":"https:\/\/cyberenso.jp\/en\/wp-json\/wp\/v2\/posts\/9124"}],"collection":[{"href":"https:\/\/cyberenso.jp\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cyberenso.jp\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cyberenso.jp\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cyberenso.jp\/en\/wp-json\/wp\/v2\/comments?post=9124"}],"version-history":[{"count":1,"href":"https:\/\/cyberenso.jp\/en\/wp-json\/wp\/v2\/posts\/9124\/revisions"}],"predecessor-version":[{"id":9125,"href":"https:\/\/cyberenso.jp\/en\/wp-json\/wp\/v2\/posts\/9124\/revisions\/9125"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cyberenso.jp\/en\/wp-json\/wp\/v2\/media\/8921"}],"wp:attachment":[{"href":"https:\/\/cyberenso.jp\/en\/wp-json\/wp\/v2\/media?parent=9124"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cyberenso.jp\/en\/wp-json\/wp\/v2\/categories?post=9124"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cyberenso.jp\/en\/wp-json\/wp\/v2\/tags?post=9124"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}