Post by @briankrebs__dup_6@infosec.exchange

2026-03-11 16:24 UTC

Breaking, new, by me: Iran-backed Hackers Claim Wiper Attack on Medtech Firm Stryker A hacktivist group with links to Iran&#39;s intelligence agencies is claiming responsibility for a data-wiping attack against Stryker, a global medical technology company based in Michigan. News reports out of Ireland, Stryker&#39;s largest hub outside of the United States, said the company sent home more than 5,000 workers there today. Meanwhile, a voicemail message at Stryker&#39;s main U.S. headquarters says the company is currently experiencing a building emergency. From the story: &quot;Wiper attacks usually involve malicious software designed to overwrite any existing data on infected devices. But a trusted source with knowledge of the attack who spoke on condition of anonymity told KrebsOnSecurity the perpetrators in this case appear to have used a Microsoft service called Microsoft Intune to issue a ‘remote wipe’ command against all connected devices.&quot; &quot;Intune is a cloud-based solution built for IT teams to enforce security and data compliance policies, and it provides a single, web-based administrative console to monitor and control devices regardless of location. The Intune connection is supported by this Reddit discussion on the Stryker outage, where several users who claimed to be Stryker employees said they were told to uninstall Intune urgently.&quot; https://krebsonsecurity.com/2026/03/iran-backed-hackers-claim-wiper-attack-on-medtech-firm-stryker/ #stryker #handala #intune #wiper #cybersecurity

Replies (18)

@briankrebs@infosec.exchange 2026-03-12 12:08

Added this as an update to the story on the wiper attack on medtech giant Stryker, which doesn't just sell medical devices: A number of hospitals have opted to disconnect from Stryker's online services to minimize risk from the attack, including LifeNet, a service used by countless hospitals to send EKGs etc. from emergency responders to the emergency room in advance of the patient arriving (to speed up treatment, minimize heart tissue damage, etc). Some states, e.g., Maryland, actually require the transmission of this information, and are asking providers who have disconnected from LifeNet to start using the phone to describe the results of EKGs recorded by emergency personnel in the field.

Open ##1597478
@notasnek@infosec.exchange 2026-03-11 16:28

@briankrebs luckily everything was perfected backed up.

Open ##1597480
@hasani@my-spaces.social 2026-03-11 16:29

@briankrebs And that is why you don’t tie personal devices to corporate systems allowing them to remote wipe your devices

Open ##1597482
@dalias@hachyderm.io 2026-03-11 16:41

@briankrebs LMAO MDM = FAFO

Open ##1597491
@cafechatnoir@mastodon.social 2026-03-11 16:42

@briankrebs This is arguably quite bad, but damn, why not wipe out the student loan servicers....

Open ##1597498
@Elmar_Iachi@chaos.social 2026-03-11 16:43

@briankrebs Intune, also known as: Palpatine as a Service.

Open ##1597504
@Fringedcrow@infosec.exchange 2026-03-11 16:45

@briankrebs apparently, they're claiming Verifone now as well.

Open ##1597509
@f4grx@chaos.social 2026-03-11 16:51

@briankrebs the cure to NAS!

Open ##1597533
@Buthowhighishigh@mastodon.social 2026-03-11 17:45

@briankrebs man it would be “so horrible” if someone somehow wiped out debt like that, so so so horrible, I could barely imagine it, and if anyone needs me I’ll be struggling to imagine it for the rest of the day

Open ##1597534
@hiphopheaven@mastodon.social 2026-03-11 17:49

@briankrebs the usa and iarael killed internstional laws

Open ##1597535
@compfu@mograph.social 2026-03-11 18:19

@briankrebs Medical companies should not be called like a weapon system or some sci-fi shit.

Open ##1597536
@stonykark@mstdn.ca 2026-03-11 18:50

@briankrebs Serves them right. Their new stretchers are garbage.

Open ##1597537
@HummingbirdSecurity@mastodon.social 2026-03-11 18:50

@briankrebs Thanks for raising awareness on this.

Open ##1597538
@TycoonTom@infosec.exchange 2026-03-11 21:48

@briankrebs The hacker's ripped out Stryker's🏥 appendix.

Open ##1597539
@TheNovemberMan@bookstodon.com 2026-03-11 22:24

@briankrebs #Microslop strikes again! 😅 #HackMicrosoft

Open ##1597540
@SpaceLifeForm@infosec.exchange 2026-03-11 23:53

@briankrebs Windows. No surprise.

Open ##1597541
@violetmadder@kolektiva.social 2026-03-12 06:44

@briankrebs OH MY. You know, in the back of my brain I've been tensing up with sick dread waiting for the next 9/11 to hit... I gotta say, I LIKE THIS MUCH BETTER.

Open ##1597542
@androcat@toot.cat 2026-03-12 11:11

@briankrebs Intune the attack vector, nice.

Open ##1597543