FBI Seizes Websites of Hacking Group Responsible for Stryker Cyberattack

The FBI has seized two websites connected to the pro-Palestinian hactivist group that incapacitated Stryker Corp.’s internal digital network last week in a cyberattack that erased files and data from systems linked to the company’s Microsoft Windows environment, multiple media sources reported.

“This domain has been seized by the Federal Bureau of Investigation (“FBI”) pursuant to a seizure warrant issued by a United States District Court for the District of Maryland as part of a law enforcement action by the FBI. Law enforcement authorities determined this domain was used to conduct, facilitate, or support malicious cyber activities on behalf of, or in coordination with, a foreign state actor,” the FBI’s seizure message reads. “These activities may include unauthorized network intrusions, infrastructure targeting, or other violations of United States law. Pursuant to the court-authorized warrant, the United States Government has taken control of this domain to disrupt ongoing malicious cyber operations and prevent further exploitation.”

The hacker group, Handala, acknowledged the seizures and vowed to create new websites to announce further cyberattacks. “To all truth-seekers and defenders of justice, We inform you that the Handala RedWanted website, which was dedicated to exposing Zionist crimes and raising global awareness, has also been seized and taken offline by order of the FBI. This aggressive action reveals the extent to which the enemies of truth will go to silence voices that unveil their atrocities,” the group said, as reported by NBC News.

Handala immediately claimed responsibility last week on social media for the cyberattack and said it conducted the data breach in retaliation for U.S. and Israeli military actions against Iran. Stryker posted a statement on its website acknowledging a “global network disruption” to its Microsoft environment but has not identified the culprits of the cyberattack. In a March 19 update, the company said it has been in close contact with federal officials about the incident and reminded customers that its products remain safe to use.

“We have been focused on proactive outreach to and collaboration with government agencies and industry partners. We are in close contact with the White House National Cyber Director, FBI, CISA, DHA, HHS, and H-ISAC, and appreciate the ongoing support they have been giving us,” Stryker’s statement read. “We’re grateful to the government for their efforts to seize domains linked to the purported threat actors. Protecting the healthcare ecosystem against cyber threats is a priority that requires extensive public-private partnership. True to our commitment to transparency and a collective cyber defense, we are committed to sharing meaningful intelligence that strengthens the resilience of patient care worldwide.

As a reminder, this incident did not affect the security or safety of our products or devices. All Stryker products across our global portfolio, including connected, digital, and life-saving technologies, remain safe to use. Some of our customers that utilize our personalized implants are experiencing some disruptions. We understand that some patient-specific cases scheduled for the week of March 16 have been rescheduled due to shipping delays we are experiencing. There is nothing more important to us than the customers and patients we serve, and we recognize the criticality of every procedure to every patient. We are working as quickly and safely as possible to reconcile orders, manufacture product, and deliver to our customers so they can continue to provide seamless patient care. This is a 24/7 effort and the first priority of our entire organization.”

The Economic Times reported that Stryker employees found a message from the hackers on their laptops and phones that read, “No need to learn Hebrew anymore. You won’t need it for much longer.” The Handala logo accompanied the message, which appeared after the cyberattack erased data from their company network-connected devices.

Stryker’s computers in Ireland also fell victim to the cyberattack. Sources told The Irish Examiner that systems in the company’s Cork headquarters have been “shut down” and Stryker devices held by employees were wiped out.

In an update on March 12, Stryker said the Handala attack appeared to be contained to its internal Microsoft environment. There was no indication of malware or ransomware, and its products like Mako, Vocera, and LIFEPAK35 are safe to use, the company reported. Stryker also said it is working to ship orders entered before the cyberattack, and is closely examining any orders that were received after the breach.

“We are working to ensure our electronic ordering system is back up and running as quickly as possible,” the update read. “It is safe to communicate with Stryker employees and sales representatives by email and phone, and within your facility.”

One worker described the attack as “very significant.” “…anyone with Outlook on their personal phones had their phones wiped,” the unnamed employee reported to The Irish Examiner.

CNN claims the cyberattack appeared to be one of the first notable pro-Iranian hacks against U.S. infrastructure since the United States and Israel began bombing Iran last month. The network said the hacker group targeted Stryker in retaliation for a missile strike on an Iranian elementary school.

Cybersecurity expert and Blue Goat Cyber CEO Christian Espinosa said the Stryker attack shows the most serious and concerning cyberattacks are those that target device management tools, as they can disrupt an organization’s entire product development cycle.

“Stryker’s latest update—that there’s no indication of ransomware or malware and connected products remain safe to use—is reassuring, but it misses the main medtech lesson. What this attack really shows is how a determined, geopolitically motivated actor can turn your own Microsoft and device‑management tools into a single point of failure—a kind of digital ‘mass casualty’ event for your operations—if you haven’t designed for blast radius and recovery,” Espinosa explained. “The uncomfortable truth is that the biggest patient impact often comes from enterprise disruption, not a device getting hacked in the field. When ordering, manufacturing, shipping, field service, and support systems stall, care can slow down very quickly, even if every implant and surgical robot is technically secure.”

“Three questions every medtech leader should be asking this week are: What are our truly ‘must‑stay‑up’ workflows, and how long can they really be down?” he asked. “If identity and Microsoft services are degraded, do we have clean break‑glass access and offline runbooks that work in practice, not just on paper? And have we actually rehearsed running the business manually for 48 hours and then restoring safely? Regulators are already moving the sector in this direction, with expectations that cybersecurity is managed across the total product lifecycle and that vulnerabilities and software supply chain risks are actively monitored and addressed. Incidents like this underline that medtech has to treat identity, device management, and business continuity as core patient‑safety functions, not back‑office IT issues.”

Stryker is based in Kalamazoo, Mich., but maintains operations in Saudi Arabia and the United Arab Emirates, both of which have been targeted by Tehran in its war with the United States and Israel.

Handala also breached the Academy of the Hebrew Language’s website on Wednesday, according to The Jerusalem Post.