“While early reports suggest a destructive wiper-style attack rather than traditional ransomware, incidents like this highlight how attackers increasingly target operational systems where disruption creates the greatest impact,” says Dr. Darren Williams, Founder and CEO of BlackFog. “When manufacturing environments are taken offline, the consequences can quickly ripple through supply chains, particularly in sectors such as healthcare where the availability of critical equipment matters.”

Based in Portage, Michigan, Stryker is among the largest medical device manufacturers in the world. Healthcare systems across the globe utilize the hospital technology and surgical equipment produced by the organization, underscoring the potential ramifications for this disruption across the global healthcare sector. 

Allegedly, this attack may be linked to Iran-connected hacktivist group “Handala,” as reports suggest imagery associated with the group was displayed on login pages, but no official attribution has been made for the attack.

As the conflict with Iran unfolds, critical infrastructure organizations operating within the U.S. are encouraged to remain vigilant. 

“Even in attacks focused on disruption, data exfiltration often remains part of the playbook. Stolen data can provide additional leverage through extortion or the threat of exposing sensitive corporate or research information,” explains Dr. Williams. “For organizations operating critical infrastructure, the priority must be preventing attackers from reaching and removing sensitive data in the first place. That means maintaining strong visibility across networks, segmenting operational systems, and detecting and blocking data exfiltration in real time before attackers gain the upper hand.”