Stryker cyber incident: hard lessons for the medtech and healthcare manufacturing supply chain

What is known so far about the cyber incident?

Stryker, a medical devices and equipment manufacturing company, confirmed that on 11 March 2026 it identified a cyber security incident affecting certain IT systems, causing a global disruption to its Microsoft environment. The company activated its incident response plan, brought in external cyber security support and began investigating the cause and impact. In its initial SEC filing, Stryker said it had no indication of ransomware or malware and believed the incident had been contained.

On 12 March 2026, Stryker confirmed that the disruption was affecting order processing, manufacturing and shipping. It also said it did not believe patient-related services had been disrupted and did not believe its connected products were impacted.

By 13 March 2026, Stryker said it was prioritising the restoration of systems supporting customers, ordering and shipping, and that its core transactional systems were on a clear path to full recovery. It also continued to state that it had no indication of ransomware or malware and that the disruption was believed to remain contained to its internal Microsoft environment.

The full scope of the incident, the root cause and any long-term financial or regulatory consequences remain unconfirmed. Stryker has said the investigation is ongoing and that it has not yet determined whether the incident is reasonably likely to have a material impact on the business.

In Ireland, Cork is Stryker’s largest innovation and manufacturing hub outside the US, with more than 4,100 employees across six sites. Any sustained disruption to core systems in a business of that scale is not just an IT issue, it is an operational problem with real-world consequences for production, logistics and confidence across the supply chain.

Why are the geopolitical considerations relevant right now?

Unconfirmed public reporting has attributed the attack to Handala, a group reported by Reuters to claim responsibility for the attack. However, Stryker itself has not publicly confirmed this.

We are operating in a period where conflict, retaliation, instability and political tension are feeding directly into cyber risk. Businesses with international operations, critical supply chains or strategic importance are increasingly exposed to disruption that may be opportunistic, ideologically driven or simply timed to exploit wider instability.

On 2 March 2026, the UK’s NCSC warned organisations to review their cyber posture following the conflict in the Middle East. While there was likely no significant change in the direct cyber threat from countries in current conflict to the UK, there was almost certainly a heightened risk of indirect cyber threat for organisations with regional presence or supply-chain links.

For global businesses, where geopolitical tensions rise, cyber risk rises too. Attackers exploit distraction, stretched teams, fragile supply chains and dependency on shared and dedicated platforms.

A business does not need to sit inside a war zone to feel the impact. It only needs to be connected to the wrong systems, the wrong suppliers or the wrong region at the wrong time.

Why does the medtech and healthcare manufacturing sector face heightened cyber risk?

• The sector relies on tightly connected environments spanning enterprise IT, manufacturing, logistics, customer fulfilment and regulated healthcare operations.
• Disruption to core platforms such as Microsoft environments, identity services and order systems can spread quickly across countries and functions.
  These organisations often hold valuable commercial, employee, supplier and customer data.
• Operational failure does not stay neatly contained in the back office. Delays in manufacturing or shipping can ripple outward into hospitals, providers and frontline services.
• In a more volatile geopolitical climate, globally connected manufacturers are under extra pressure because they sit at the intersection of technology, supply chain and essential service delivery.

What are the common tactics attackers use against the sector?

• Phishing and impersonation emails aimed at staff, suppliers and commercial teams.
• Use of compromised credentials and poorly protected privileged accounts.
• Exploitation of weak remote access controls, cloud administration tooling or identity infrastructure.
• Unpatched internet-facing systems and security gaps across complex global estates.
• Lateral movement through enterprise environments once initial access is gained.
• Disruptive attacks designed to knock out operations, not just steal data.

The exact attack path in Stryker’s case has not yet been publicly confirmed, but these are familiar pressure points across the sector and the type of disruption now seen in major cross-border incidents.

The Stryker incident is a sharp reminder that a cyber attack does not need to involve complex advanced threats such as ransomware for critical impact. If your systems cannot process orders, support manufacturing or move product, the damage is already real.

In the current geopolitical climate, every globally connected organisation should assume the margin for error is getting thinner, not wider.

How can Moore Kingston Smith help?

The Stryker incident underlines a point many organisations still resist: cyber resilience is not just about keeping attackers out; it is about keeping the business standing when something gets through.

For manufacturers, healthcare suppliers and other operationally critical businesses, that means hardening core systems, tightening governance, understanding data exposure and making sure continuity plans work in the real world, not just on paper.

If your organisation has been affected by a similar incident, or if you want to examine your cyber resilience in the context of today’s geopolitical volatility, contact us. A focused conversation can help identify weak spots quickly, cut through false comfort and place practical priorities in action before the next disruption lands.