Yesterday, reports began to surface that an Iranian-backed “hacktivist” group managed a “wiper attack” against Stryker, targeting data on Stryker’s Microsoft-based IT system and effectively wiping it out so it can’t be retrieved. The group said it undertook the cyberattack in response to U.S. and Israeli attacks on Iran, beginning on Feb. 28, 2026.
Stryker later confirmed that it faced the attack, but has yet to disclose the full scale or impact. The orthopedic giant says there is no indication of malware or ransomware and that it believes that the situation is contained to its internal Microsoft environment only.
According to Stryker, connected devices like Mako, Vocera and LifePak35 remain safe to use.
While the company continues to investigate the wider effects of the attack, the potential ramifications for the medtech industry are also open to examination.
Mike Kijewski, CEO of MedCrypt — which helps healthcare technology companies ensure medical devices are secure from cybersecurity threats and vulnerabilities — spoke to MassDevice about what the cyberattack on Stryker could mean for medtech and healthcare as a whole.
The following has been edited lightly for space and clarity.
MassDevice: What is your initial reaction to the cyberattack on Stryker, based on what we know from various reports?
Mike Kijewski: “It is a particularly interesting target for cyber criminals, especially nation-state actors, for two reasons. No. 1 is the financial incentive of attack, or the financial disruption that it causes in a very important sector in the U.S. No. 2 is the potential clinical implications of a healthcare technology company being attacked.
“If you’re a nation-state wanting to do harm to the U.S., you can attack banks, and there’s a financial impact. You can attack the energy sector, and there’s critical infrastructure impacts. Healthcare has both. I frequently hear healthcare technology companies say, ‘Well, why would somebody want to hack us? We don’t have credit card data. We’re not a bank.’ This event makes it clear that healthcare companies are an even more attractive target for bad actors than targets whose impact would be purely financial.”
In your experience, have you seen an attack like this where, based on reports, it’s directly tied to ongoing geopolitical events?
MK: “This is the first instance that I’m aware of in the last 10 years of a nation-state-backed actor attacking an organization specifically in the context of war or geopolitical disturbances. There’s obviously lots of examples of activists and anonymous doing things. There are examples of purely financially oriented threat actors who are backed by nation-states, who have engaged in various different ransomware schemes.
“My understanding of this attack, or what I’ve read about the attack, is that this wasn’t a ransomware attack. This is an attack where they actually wiped all of the devices, which says that this actor isn’t just trying to get $10 million in Bitcoin. They are specifically trying to inflict harm on a U.S. company, both financially and potentially having clinical impact on patients. I don’t know if Stryker will have any [impact on patients], but this is the first attack like this that I’m aware of in recent memory.”
Considering the type of attack, from what we know, does the motive appear to primarily target a business disruption?
MK: “There are people who are experts on specific threat actors and class classes of attacks, so, take this with a grain of salt. However, it’s interesting. Most of the categories of attacks that I’m aware of are either purely financial, where they are ransomware attacks and the goal is to extract money from the victim, or they are super focused attacks that are meant to have really specific disruptions. [These are] things like the Stuxnet attack … that was specifically crafted to disrupt. That’s motivated and has a really specific target.
“In this case, if what we are reading is correct, and the attackers just wiped all of Stryker’s devices, rather than a rifle attack, it’s a shotgun attack. It’s ‘we want to take down all of your functions, and not even give you the opportunity to give us money to get your data.’”
What is the significance of a targeted attack like this, specifically with regard to healthcare and medtech?
MK: It highlights, to me, the fact that the U.S. healthcare infrastructure is a real prime target and a soft target, relatively speaking, for attackers who would want to do bad things to the U.S. There have been studies that have shown that the U.S. healthcare industry spends substantially less on cybersecurity than other comparable industries like financial services or even the utilities and, critical infrastructure, like energy companies. I think the root cause for that is that, 15 or 20 years ago, the consensus was that hackers wouldn’t be interested in attacking healthcare because there wasn’t a lot of financial benefit in doing so. If you hack a bank, you can steal its money. Why would anybody ever want to hack a hospital?
“I believe that we will, as a country, understand that healthcare is an equal, if not more attractive, target than financial services to people who would want to do harm in the U.S. Therefore, the healthcare sector will spend as much or more on cybersecurity defenses than the financial services industry will. We are somewhere between those two points. We went from spending almost nothing on cybersecurity and healthcare, and we are on our way to spending an appropriate amount of money and an appropriate amount of resources, but we’re certainly not there yet.”
In the wake of this attack, will there be concern among other medtech companies around their cybersecurity measures?
MK: “I haven’t spoken to other device manufacturers about their response to this particular event. I do know that in the past, when things like [the Change Healthcare cyberattack] have happened, it has caused medtech companies to take cybersecurity much more seriously. [It spurred] board-level discussions about what we’re doing to prevent similar attacks.”
“I am very confident that other large device manufacturers are having meetings as we speak, saying, ‘Is there reason to believe that we would be a target, and what can we do to protect ourselves?’”
What are the challenges of protecting yourself from an attack like this?
MK: “The challenge is, in a case where a company falls victim to a ransomware attack from a group of three or four hackers in a basement in Eastern Europe, that’s one thing. It’s conceivable, seeing a private organization defending themselves against an attack [like that].”
“How are they supposed to defend themselves against a nation-state? In this case, it sounds like it wasn’t a nation-state, specifically, but it was a threat actor that is backed by a nation-state. It is a tall order to ask healthcare technology companies to defend themselves from a nation-state. It’s an even taller order to ask hospitals to do so. Stryker is the third-largest medical device manufacturer by market cap. They’re profitable. If they decide that they want to invest more money in cybersecurity, they have the ability to do so.
“The median hospital in the U.S. loses money. If we are now saying, as a country, our healthcare infrastructure can be the target of an attack by a nation-state, and we need both device manufacturers and software companies and hospitals to defend themselves. It’s not clear to me where the resources will come from for hospitals to even attempt to defend themselves against an attack of this magnitude.”
How to move forward
MK: “There’s no reason for anybody to shame Stryker for being in this situation. I think a lot of companies, when they are victim to a cyberattack, fear litigation or people claiming that they weren’t securing their networks adequately. There’s nothing to suggest that Stryker wasn’t doing everything they possibly can to defend themselves. If you look at other categories, like mass casualty events, we do a root cause analysis. We figure out what the root cause was, we publish it widely, and we tell all others to avoid that particular problem, either by replacing a specific part or upgrading some software or changing a process.
“For some reason, in healthcare, companies are so afraid of litigation or liability that when an attack like this happens, their instinct is to not communicate to others. We would be better off as an industry if other medtech companies were able to learn exactly what led to the Stryker breach so that they can prevent it in their own organizations.
“I fear that there’s so much stigma associated with cyber breaches that it’s unlikely that anybody would voluntarily share that information. [There’s] no reason to shame Stryker. They were taken down by a nation-state-backed actor. It’s a tall order to ask them to be able to defend themselves with something like that, and we need to figure out, as a country, how to encourage organizations that have been the victims of attacks like this to share their learnings so that other people can learn from it and prevent similar outcomes.”
Blue Goat Cyber’s take on the incident
Blue Goat Cyber, another cybersecurity firm, provides full-service medical device cybersecurity support. It aims to address challenges throughout the premarket and postmarket phases.
On LinkedIn, the company said: “Events like this are a reminder of how important operational resilience is across the healthcare technology ecosystem.”
In written responses to questions emailed by MassDevice, Founder and CEO Christian Espinosa provided his point of view on the incident.
MassDevice: With the information we have available, what is your overall reaction to this event and its implications?
Christian Espinosa: “Based on what Stryker has publicly shared so far, this reads as a serious enterprise disruption incident. Stryker has communicated that it has no indication of ransomware or malware at this time, believes the incident is contained, and that the disruption is centered on its internal Microsoft environment, with restoration still in progress. They’ve also said key products remain safe to use, which is the most important message for clinicians and patients.
“The bigger implication for medtech is that many of the most consequential cyber events are not ‘device hacks.’ They are disruptions to the business systems that keep healthcare moving, like identity, email, ordering, shipping, and customer support. When those systems wobble, hospitals feel it quickly. That is why the conversation has to include resilience and recovery, not just prevention.”
Has there been a cyberattack of this nature, whether in MedTech or elsewhere, that was directly tied to geopolitical events as this one appears to be?
CE: “Yes. Outside of medtech, there are widely cited examples of cyber activity aligned with geopolitical escalation, with the objective appearing to be disruption, signaling, or pressure rather than purely financial gain. One of the clearest “timed to a geopolitical moment” examples is the KA-SAT/Viasat disruption on February 24, 2022, which disrupted communications around the start of Russia’s invasion of Ukraine. Another is NotPetya in June 2017, often cited as a destructive, high-collateral-impact campaign tied to geopolitical conflict dynamics. And from a healthcare impact lens, WannaCry in May 2017 is a strong reminder of how quickly large-scale cyber events can disrupt care delivery.
“For this specific incident, I’d still be cautious. Attribution and motive take time to validate, and early claims can move faster than confirmed facts. The safest takeaway is that periods of geopolitical tension tend to raise the likelihood of disruptive cyber activity, so medtech companies should plan for resilience accordingly.”
What are the implications for Stryker and other MedTech companies that could be susceptible to an attack like this?
CE: “For Stryker, the near-term implications are continuity and confidence. That means restoring core services quickly, communicating clearly with customers, maintaining logistics and service delivery as best as possible, and determining the full scope of impact. In incidents like this, how a company recovers and communicates matters as much as the technical details.
“For other medtech companies, this highlights a hard reality: large manufacturers are high-leverage targets. If a major supplier’s enterprise environment is disrupted, that can create downstream friction across many hospitals and health systems. The industry lesson is to be ready to operate through degraded IT conditions while still meeting customer needs.”
Are there any mitigations or other concerns in the wake of this?
CE: “A few practical priorities I’d emphasize for MedTech companies, without speculating about any one organization’s controls:
-
Recovery readiness: immutable or offline backups are table stakes, but the differentiator is tested restoration. You want proven rebuild paths for identity and collaboration platforms, not a plan you’ve never exercised.
-
Identity and privileged access: strong MFA, reduced standing privileges, privileged access management, and tight monitoring for abnormal authentication activity.
-
Limit blast radius: segmentation and least privilege so a single foothold cannot cascade into an enterprise-wide outage.
-
Endpoint resilience: the ability to rapidly re-provision devices and keep teams productive if endpoints become unusable.
-
Customer continuity planning: out-of-band communications and clear processes for ordering, service, and support when primary systems are impaired.
-
Lifecycle discipline: secure development practices plus strong vulnerability management and coordinated disclosure as part of a total product lifecycle approach.
The main concern in the first days is always the same: don’t let assumptions outrun facts. Communicate what’s confirmed, focus on restoring operations safely, and use the event to harden resilience across the sector.”
