Stryker’s wipe made a supplier’s admin console a hospital supply risk

The week

On March 11, 2026, medical technology maker Stryker disclosed a cyberattack that disrupted its global Microsoft environment, the email, files, logins and device-management systems that much of a modern company runs on. Handala, a persona that security researchers link to Iran’s intelligence ministry, claimed responsibility and made no ransom demand.

Most hospital leaders have a mental script for a cyberattack: criminals lock up the computers, demand money, and the organization decides whether to pay. This attack did not follow that script, and money was not the object.

In its SEC filing, the formal disclosure public companies must make when something material happens, Stryker said it had no indication of ransomware or malware, believed the incident was contained, and was still assessing the impact. Ransomware is malicious software that scrambles an organization’s data until a ransom is paid; malware is the broader family of harmful programs. Stryker was saying, in effect, that no such program had been found.

In separate customer updates, it said named products, including its Mako surgical robots, were safe to use, and that it was working to restore electronic ordering, which was unavailable. That last point is where the story reached hospitals. A hospital that cannot place an electronic order with a major supplier of implants and surgical instruments has a problem in its operating rooms within days. Some sites reverted to manual processes: phone calls, paper and spreadsheets.

Press reports, citing people familiar with the investigation, offered an account of how it had happened without malware. They said the attackers compromised an administrator account, created a new global administrator, and used Microsoft Intune’s built-in remote wipe to erase a large number of devices.

Intune is a widely used tool that lets a company’s IT team manage its laptops and phones from a central console: install software, enforce settings and, if a device is lost or stolen, erase it remotely so its data cannot be read. A global administrator is the most powerful account in a Microsoft environment, roughly the master key to the building. If the reports are right, the attackers walked in with a master key and used the company’s own eraser.

Stryker did not publicly confirm the method. But the possibility alone was enough to send security teams across healthcare to check who in their own organizations held the same keys.

Healthcare security planning is built around ransomware: encrypt, demand, negotiate, restore. The Stryker incident did not follow that script. There was no ransom demand, and the company reported no malware. If the reporting is right, the attackers brought no weapon of their own and used one the company already owned, an administrative tool designed to erase lost laptops.

The incident runs through three layers, each with a different owner. The management plane that was reportedly turned against the company belongs to identity and endpoint teams, in any organization. The supplier’s operations, which stopped, belong to the supplier but are assessed by the hospital’s vendor risk function. And the hospital’s own dependency on those operations belongs to supply chain and clinical leaders. Hospitals need a view on all three, because they run the same tools and depend on the same suppliers.

Endpoints, consoles and the master key

Three ideas make the rest of the story easy to follow.

An endpoint is any device a person works on: a laptop, a desktop, a phone, a tablet, a nursing workstation on wheels. Large organizations have thousands of them. An endpoint management platform, such as Microsoft Intune, manages all of them centrally. From one console, IT can push out a software update to every laptop overnight, require screens to lock after five minutes, or erase a phone left in a taxi. It is enormously useful, which is why nearly every large organization has one.

The management plane is the collective name for these systems: the consoles and accounts that tell everything else what to do. Whoever controls it controls everything beneath it.

Identity is the system that decides who is who and what they are allowed to do. In most organizations that run Microsoft, the identity platform sits above Intune. It decides which accounts are administrators, and of what. A global administrator can change almost anything, including creating new administrators. That is why the reported method, compromising one administrator and then creating another, matters so much: once an attacker can make new keys, changing the locks underneath does not help.

Put together, the risk is easy to state. A feature built to protect lost devices becomes, in the wrong hands, a way to erase every device at once. No malicious software is needed, so tools built to detect malicious software will not see it coming.

How an attack like this unfolds

The reported sequence breaks into four steps, and each is a place where a defense could have stopped it.

Step one: get a foothold. The attacker obtains the login of someone with administrative rights. The public reporting did not say how in this case; in general, the usual routes are a convincing phishing email, a password reused from another breached site, or a login that accepts a password alone. Strong, phishing-resistant multi-factor authentication on every administrator account is the defense here.

Step two: make a master key. Using that foothold, the attacker creates a brand-new global administrator account. This is a moment that should ring alarm bells. Healthy organizations create new global administrators rarely, and each one should be expected, approved and noticed.

Step three: use the organization’s own tools. With full rights, the attacker opens the endpoint management console and issues a wipe to large numbers of devices. Every command looks legitimate, because technically it is. The platform is doing exactly what it was built to do.

Step four: the business stops. Laptops and phones reset to factory settings. Staff cannot reach email, files or the applications that take orders and run shipping. Recovery means rebuilding devices, often by hand, and restoring the systems that depend on them.

Seen this way, the defenses line up neatly: stop the foothold, notice the new master key, require more than one person for the destructive command, and alert a human when it happens anyway. Each layer buys time, and no single one is enough.

The contrast with ransomware is instructive. Ransomware holds data hostage, which at least gives the victim a counterpart and, sometimes, a way back. A wipe offers nothing to negotiate. The only way back is the organization’s own backups, rebuild procedures and patience, which is why recovery planning matters as much as prevention.

The management plane

Endpoint management platforms push software, change configurations and, by design, erase devices. At scale and in the wrong hands, that last feature is destructive. One account with the right role can issue commands to every enrolled laptop, phone and, in some estates, server.

Within days, CISA, the federal cybersecurity agency, urged organizations to harden endpoint management systems. Its recommendations, with the jargon unpacked:

• Least-privilege administrative roles: give each administrator only the powers their job needs, so the person who installs printer drivers cannot also wipe the company.
• Phishing-resistant multi-factor authentication for privileged accounts: a second proof of identity, such as a physical security key, that cannot be tricked out of someone by a fake login page.
• Conditional access: rules that check the circumstances of a login, such as where it comes from and on what device, before letting it through.
• Multi-administrator approval for high-impact actions such as wipes, scripts and role changes: a two-person rule for the most dangerous buttons.

Those controls are necessary, and many organizations had not switched them on. They are also not sufficient on their own. Practitioners pointed out that an attacker who controls the identity platform above the endpoint tool can create a second administrator and approve their own request. The two-person rule fails if one person can manufacture the second.

The protection has to start one tier higher. Global and privileged identity roles should be few, held through just-in-time elevation rather than standing rights, and monitored for the creation of new administrators. Just-in-time elevation means an administrator’s account is ordinary most of the time and gains powerful rights only for a short, approved, logged period when a specific task requires it. Bulk destructive actions should raise an alert that reaches a person within minutes, whatever approvals were given.

A health system can test its own exposure by counting the accounts that can issue a bulk wipe, directly or by granting themselves the right; checking whether any of them are used for routine work; and finding out whether anyone would notice if a thousand devices received a reset command at two in the morning. Clinical workstations, shared nursing devices and medical carts enrolled in the same platform make the answers more urgent.

The supplier’s operations

Stryker said its products were safe to use, and nothing in the public record suggests patient-facing devices were compromised. The disruption was to the business: ordering, manufacturing and shipping. That is the part of a medical supplier that hospital reviews rarely examine.

Vendor risk programs in healthcare are built around data. They ask whether the supplier holds protected health information, the patient records that HIPAA protects; whether it is a business associate, the legal term for an outside firm that handles such records on a provider’s behalf; and whether its device ships with a software bill of materials, an ingredients list of the software components inside a device. Those questions matter, but they miss operational dependency entirely. A supplier that holds no patient data can still disrupt surgical schedules if it cannot take orders, ship implants and instruments, or send the field representatives who support certain procedures.

Hospitals can ask suppliers different questions: how they would take orders if their electronic systems were unavailable for two weeks, how quickly they could restore order processing and whether they have tested it, and how they would prioritize and inform customers during a backlog. Group purchasing organizations, the buying cooperatives that negotiate contracts on behalf of many hospitals, can ask these questions at scale and share the answers with members. Even where a hospital cannot win contractual commitments, the answers show which suppliers have rehearsed recovery and which have not.

The hospital’s dependency

For a health system, the third layer is the one that touches patients. Orthopedic, surgical and neurovascular supply chains are concentrated, and many hospitals hold limited consignment inventory that depends on frequent replenishment. Consignment inventory is stock the supplier places on the hospital’s shelves but still owns until it is used in a procedure. It saves the hospital money and space, but it means the shelf is only as full as the supplier’s ordering and shipping systems keep it. When a major supplier’s ordering stops, the effect arrives in days.

The response combines supply chain and clinical planning. Supply chain leaders should know which procedures depend on a single supplier and how many days of inventory they hold on site and in consignment. They should also hold a manual ordering path, with names and phone numbers, for when electronic ordering fails. Clinical leaders should know which cases could be rescheduled or moved to alternative products without compromising care, and who decides.

The Change Healthcare outage in 2024 showed how a third party’s downtime becomes a provider’s problem in claims and payments. Stryker extended that to physical supplies. The two events also differ in who notices first: a claims outage shows up in finance, while a supply outage shows up in the operating room schedule.

Contracts are the underused lever. Supplier and group purchasing agreements usually cover price, delivery and quality. Few cover restoration of ordering after an outage, a manual fallback, or customer notification during a disruption. Those terms can be negotiated, especially for single-source products and at renewal. A tabletop exercise in which a top-five supplier loses ordering and shipping for two weeks, with no data breach involved, is the quickest way to find out which terms matter most. (A tabletop is a structured rehearsal around a conference table: leaders talk through a realistic scenario hour by hour, and discover the gaps before a real event does.)

Same news, two fortnights

Suppose a four-hospital system with a busy orthopedic program learns on a Wednesday morning, through its materials manager, that a major implant supplier cannot accept electronic orders. The supplier says products are safe; the problem is its own systems.

At an unprepared system, the news travels slowly. The materials team assumes it is a brief glitch. By Friday, consignment shelves for knee and hip implants are thinning, and surgeons hear about it when a case is postponed on the morning of surgery. Nobody is sure who can authorize substituting another supplier’s product, and the vendor risk file for this supplier, focused on data, has nothing useful to say.

At a prepared system, the same news triggers a short playbook rehearsed in last year’s tabletop. Supply chain pulls a list of procedures that depend on the supplier and a count of days on hand. The manual ordering path, a named contact and phone number at the supplier, is used the same day. The chief medical officer and the orthopedic chair review the next two weeks of cases and agree which can proceed, which can switch products, and which should move. Patients are told early, not on the morning of surgery.

Meanwhile the system’s own security team, reading the same press reports, counts how many accounts can wipe its devices. It finds more than it expected, including two used for everyday work, and fixes that within the week. Same news, two very different fortnights.

What a postponed knee replacement costs

Patients and clinicians. A postponed surgery is a human event: a patient who took time off, arranged care and prepared for an operation that does not happen. Supply resilience is patient experience.

Money. Cancelled and rescheduled cases cost revenue and operating room time, which is among the most expensive capacity a hospital has.

Risk and regulators. A hospital’s own management plane is as exposed as Stryker’s reportedly was. A mass wipe of clinical workstations would disrupt care far more directly than a supplier outage.

Reputation. Communities judge a hospital by whether it kept its promises, not by whose systems failed.

Staff. When devices are wiped or ordering stops, the burden falls on nurses, schedulers and materials teams, who improvise with phones and paper while still caring for patients. A rehearsed manual path turns that improvisation into a procedure, and protects people who are already stretched.

Governance. Boards are used to asking about data breaches. Fewer ask how many people can erase the organization’s devices, or which suppliers could halt surgery if their systems failed. Both questions are cheap to ask and revealing to answer, and the risk committee can ask both alongside the more familiar ones.

Few keys, loud alarms, rehearsed fallbacks

The prepared organization has a small number of powerful administrators, elevated only when needed and watched closely; alerts that wake a person when thousands of devices receive a destructive command; supplier reviews that ask about operations as well as data; a known list of single-supplier procedures with days of inventory; and contracts that say what happens when a supplier’s systems go dark.

The recurring errors:

• Planning only for ransomware. Assuming every attack comes with a ransom note and a negotiation window.
• Trusting approvals alone. Turning on two-person approval without protecting the identity layer that creates the people.
• Everyday admin accounts. Letting staff use powerful accounts for routine work, so one stolen password becomes a master key.
• Data-only vendor reviews. Treating a supplier with no patient data as low risk.
• Finance-only incident plans. Rehearsing a claims outage but never a supply outage.

Who can press the eraser

1. How many accounts in our organization could erase all our devices, directly or by giving themselves the right, and are any used for everyday work?
2. Would someone be alerted, within minutes, if a thousand devices were told to reset in the middle of the night?
3. Which procedures depend on a single supplier, and how many days of inventory do we hold for each?
4. If our top supplier could not take electronic orders tomorrow, whom would we call, and who decides whether to reschedule cases or switch products?
5. Which supplier contracts say anything about restoring ordering or notifying us during an outage?

With hindsight

Stryker’s recovery was faster than many feared but not free. In an amended SEC filing on April 9, the company said it was fully operational across its global manufacturing network and had restored ordering and distribution, while confirming a material impact on first-quarter results. “Material” is the accountant’s and lawyer’s word for big enough that investors would want to know. It said it did not expect a material impact on full-year guidance, its public forecast for the year. By the summer, it was still working through an order backlog.

A well-resourced global company had restored its core operations by the time of its April filing, yet the backlog lasted well beyond that. For hospitals, the backlog showed that a supplier’s recovery and its customers’ recovery are different things: shelves refill in the order the supplier chooses, and hospitals that had a relationship, a contact and a plan were better placed in that queue.

The incident was widely cited afterward for two reasons. It showed a destructive, non-financial attack on a major U.S. healthcare supplier during an active geopolitical conflict. And the reported method moved attention from malware detection to administrative controls, prompting CISA’s guidance on endpoint management hardening.

That second shift is the lasting one. For years, security budgets have gone largely toward spotting malicious software. An attack that uses the organization’s own tools, with legitimate commands from an account that looks like an administrator, slips past that kind of defense. Protecting the people and accounts who hold the master keys is now at least as important as detecting intruders.

Figures for the number of devices wiped and data taken came from the attackers or unnamed sources and were never independently confirmed, so we do not rely on them. The conclusions do not depend on those details. Whatever the exact count, the questions for any health system are the same: who can press the eraser, and what happens to patients when a supplier cannot take an order.