Two-Minute Recap - IT Law Matters Around The Globe - 2026 March

One Stolen Password, 200,000 Wiped Devices: The Stryker Attack

Iran-linked hacktivist group Handala compromised a Microsoft Intune Global Administrator account at medical device company Stryker through an adversary-in-themiddle phishing attack, then used the platform’s built-in wipe command to factory-reset between 80,000 and 200,000 devices across 79 countries overnight. No malware was deployed , only a legitimate IT management tool turned against its owner. Ordering, manufacturing and shipping systems went offline; surgical procedure delays were reported at hospitals relying on Stryker equipment. CISA issued an emergency advisory on 18 March urging all organisations to require multi-admin approval for high-impact Intune actions, enforce phishing-resistant MFA on admin accounts, and deploy Privileged Identity Management for just-in-time access.