An Iran-linked group has reportedly launched cyberattacks against U.S. and Israeli targets in retaliation for the two countries’ military strikes against Iran.
The hacking group known as Handala has presented itself as pro-Palestinian but is widely believed in the cybersecurity community to operate as a front for Iranian government interests.
Handala took responsibility for a cyberattack on the Michigan-based medical device manufacturer Stryker on Wednesday. The group claimed it wiped more than 200,000 servers, mobile devices, and other systems, stole 50 terabytes of data, and forced the shutdown of offices in 79 countries.
“We announce to the world that, in retaliation for the brutal attack on the Minab school and in response to ongoing cyber assaults against the infrastructure of the Axis of Resistance, our major cyber operation has been executed with complete success,” a statement on Handala’s website read, Wired reported. “This is only the beginning of a new era of cyber warfare.”
Stryker, a Fortune 500 company specializing in surgical equipment, orthopedic implants, and neurotechnology, which serves more than 150 million patients worldwide, reported a disruption to its Microsoft environment.
“Stryker is experiencing a global network disruption to our Microsoft environment as a result of a cyber attack. We have no indication of ransomware or malware and believe the incident is contained,” the company said in a statement on March 11.
Employees and contractors reportedly saw the Handala logo on login pages, with phones, laptops, and Windows systems hit particularly hard. Stryker told workers not to turn on company devices and to disconnect from all networks immediately.
In later updates, the company said the situation remained limited to its internal Microsoft environment. It stressed that several key products, “like Mako, Vocera, and LIFEPAK35 are fully safe to use and that it has business continuity measures in place to continue supporting customers and partners.
Mako is a robotic-arm-assisted surgical system used for joint replacement surgeries. Vocera is a wearable hands-free communication device for medical professionals, and the LIFEPAK35 is a cardiac monitor and defibrillator.
In a Reddit thread, one user posted,” My wife had 3 Stryker-managed devices wiped around 3:30 AM EDT. Their Entra login page was defaced with the Handala logo.”
Other Reddit users from various countries responded, reporting similar issues with their medical devices.
The outage affected emergency medical services in at least one U.S. state. Maryland’s Institute for Emergency Medical Services Systems notified hospitals that Stryker’s Lifenet electrocardiogram transmission system was “non-functional in most parts of the state.” Officials advised EMS clinicians to initiate radio consultation with receiving hospitals instead, adding that there was no effect on patient care.
Stryker shares fell more than 3% after reports of the breach emerged. The company employs approximately 56,000 people and reported more than $25 billion in revenue in 2025.
On the same day as the Stryker cyberattack, Handala also hacked the Academy of Hebrew Languages website and posted a threatening message in English on the home page.
“There is no need to learn Hebrew anymore. You won’t need it for much longer,” read the message, which included the logo of the Handala group, The Jerusalem Post reported.
The language website attack followed an unusually large cyberattack aimed at disrupting websites and financial services across Israel. The cybersecurity company Imperva reported that the attack peaked at 1.2 million requests per second in an attempt to overwhelm servers.
