Hacktivist Group Handala Wipes Tens of Thousands of Stryker Employee Devices via Microsoft Intune, Disrupting Global Operations
What Happened – A pro‑Palestinian hacktivist group identified as Handala (linked to Iran‑backed Void Manticore) compromised a privileged Global Administrator account in Stryker’s Microsoft Intune environment. Using the native “wipe” command, the attackers remotely erased data on roughly 80,000 employee devices and forced the shutdown of electronic ordering systems across 79 countries. The group also claims to have exfiltrated ~50 TB of corporate data, though verification is pending.
Why It Matters for TPRM –
- A single compromised cloud admin can disable an entire workforce, highlighting the need for strict privileged‑access controls on third‑party SaaS platforms.
- Potential data exfiltration of massive volumes raises concerns about downstream supply‑chain exposure and regulatory breach reporting.
- The incident shows that hacktivist actors can weaponize legitimate cloud management tools, bypassing traditional malware detection.
Who Is Affected – Healthcare‑technology manufacturers, hospitals and clinics that source devices or services from Stryker; any organization that relies on Microsoft Intune or similar MDM solutions for device management.
Recommended Actions –
- Review and tighten privileged‑access management (PAM) for all cloud‑based admin accounts, enforcing MFA and just‑in‑time elevation.
- Conduct an audit of Microsoft Intune configurations and enable audit‑logging for admin actions.
- Verify that no patient‑related data or connected medical devices were accessed; if any, initiate breach‑notification procedures.
- Re‑evaluate third‑party risk contracts with Stryker and Microsoft, ensuring clauses for rapid incident response and data‑loss protection.
Technical Notes – The attackers leveraged stolen credentials to create a new Global Administrator account, then issued the Intune “wipe” command across the tenant. No malware or ransomware was deployed. Reported impact: ~80 k devices wiped, electronic ordering systems offline, claimed 50 TB data exfiltration. Investigation led by Microsoft DART with support from Palo Alto Unit 42. Source: Security Affairs