Stryker attack used Microsoft Intune's remote wipe to erase devices, no malware needed

In March 2026 medical technology company Stryker had tens of thousands of employee devices wiped without any malware. According to reporting, the attacker took over an administrator account, created a new Global Administrator, and used Microsoft Intune's built-in remote wipe. For anyone running cloud device management, this is the clearest recent example of an admin plane being the weapon.

What happened

On 11 March 2026, between roughly 05:00 and 08:00 UTC, about 80,000 devices in Stryker's Microsoft environment were remotely wiped, according to Security Affairs. Employees in several countries found their managed laptops and phones reset. Some personal phones enrolled in corporate management also lost personal data.

A source told BleepingComputer that the attacker compromised an administrator account, created a new Global Administrator account and then issued Intune wipe commands. Microsoft's Detection and Response Team (DART) led the investigation with Palo Alto Networks' Unit 42.

Stryker said the attack was limited to its internal Microsoft corporate environment, that it was not ransomware, and that its medical devices and connected products were unaffected and safe to use. Electronic ordering was down, so customers had to order through sales representatives while transactional systems were restored.

The hacktivist persona Handala claimed responsibility, saying it wiped more than 200,000 systems and stole 50 TB of data. Investigators did not confirm those claims. Handala is widely reported to be linked to Iranian state-backed actors. On 18 March CISA urged organisations to harden endpoint management systems, and Microsoft published Intune security best practices.

Who is affected

• Stryker employees and customers, through device loss and order disruption.
• Any organisation using Intune or another cloud MDM/UEM (Jamf, Workspace ONE, Google endpoint management), where one privileged identity can issue destructive commands to the whole fleet.
• BYOD users whose personal devices are fully enrolled rather than managed through app protection policies.

What it means for developers and engineering teams

Security teams often focus on malware, but this attack used a legitimate, audited feature exactly as designed. Fleet-wide wipe is the cloud equivalent of rm -rf across every machine. The control that failed wasn't endpoint protection. It was identity and authorisation on the control plane.

The same pattern applies to anything engineering teams run with a "do it to everything" API: Kubernetes cluster-admin, cloud org-level IAM, CI/CD with production deploy rights, backup consoles that can delete snapshots. The design questions are the same everywhere:

• Can a single identity perform an irreversible action at fleet scale?
• Does creating a new highly privileged account trigger an alert and need approval?
• Are destructive operations rate-limited or batched, so a mistake or attacker can't reach 100% of targets in minutes?
• Do privileged roles require phishing-resistant MFA and just-in-time activation instead of standing access?

Recovery planning matters as much as prevention. A fleet-wide wipe turns into a provisioning problem: how fast can you rebuild thousands of laptops with Autopilot or a similar zero-touch flow, and does that flow depend on the same tenant the attacker controls? Teams should know which systems (order processing, build infrastructure, on-call tooling) can run if every corporate endpoint is reset at once, and test that assumption before an incident forces it.

What to do now

1. Turn on Intune Multi Admin Approval for wipe, retire and delete actions, script deployment and RBAC changes, so a second admin must approve.
2. Apply least-privilege Intune RBAC with scope tags. Few people need wipe rights across every device.
3. Require phishing-resistant MFA (FIDO2 or passkeys) and Conditional Access for all admin roles, limited to compliant privileged-access devices.
4. Use just-in-time elevation (Entra Privileged Identity Management) for Global Administrator and Intune Administrator. Keep standing assignments close to zero, plus monitored break-glass accounts.
5. Alert on role assignments, especially new Global Administrators, and on bursts of device actions in Intune audit logs.
6. Use app protection (MAM) for BYOD instead of full enrolment, so a wipe removes corporate data only.
7. Apply the same review to Kubernetes, cloud and CI/CD admin planes: list your destructive fleet-wide APIs and who can call them.

Related on TechLogHub

• What is authorization?
• What is authentication?

Sources

• Security Affairs: Attack on Stryker's Microsoft environment wiped employee devices without malware
• CISA: CISA urges endpoint management system hardening after cyberattack against US organization
• Microsoft: Best practices for securing Microsoft Intune
• Redmond: CISA, Microsoft outline Intune safeguards