When a cyber attack wipes hundreds of thousands of systems at a global company, it’s easy to assume the lessons only apply to organisations with enormous security teams.
But incidents like this often reveal something more useful.
They show how attacks actually unfold.
And the uncomfortable truth is that the mechanics behind many large breaches are often the same ones that affect small and medium sized businesses every day.
The recent attack claimed by the hacktivist group Handala against medical technology giant Stryker is a good example.
The reported scale of the attack
On 11 March 2026, the Iran-linked hacktivist group Handala claimed responsibility for a cyber attack against Stryker, a Fortune 500 medical technology company employing around 56,000 people across more than 60 countries.
The reported scale was staggering.
More than 200,000 servers, mobile devices and other systems were allegedly wiped.
Staff were reportedly instructed to disconnect from the network and power down devices immediately, while offices across dozens of countries experienced disruption.
Early reporting suggested the incident was contained within Stryker’s internal Microsoft environment and notably there was no ransomware demand.
Which makes this incident particularly interesting.
Because this wasn’t ransomware.
It was reportedly a wiper attack.
Ransomware vs wiper: A critical difference
Ransomware is designed to make money.
Files are encrypted and organisations are pressured to pay for a decryption key. Criminal groups run ransomware like a business.
There’s negotiation.
There’s a payment demand.
There’s usually a path to recovery.
Wiper malware works differently.
Its purpose is destruction.
Instead of encrypting files, it overwrites disks, deletes operating systems and removes system data, leaving organisations with systems that cannot easily be restored.
There’s no ransom.
There’s no negotiation.
The objective is disruption and damage.
Why target Stryker?
Handala stated the attack was retaliation linked to geopolitical tensions involving Iran.
Security researchers have previously connected the group to Iran’s Ministry of Intelligence and Security and its activity has increasingly blurred the line between hacktivism and state-aligned cyber operations.
Cyber conflict is no longer confined to government networks or military targets.
Private companies, particularly those operating in healthcare, manufacturing and global supply chains, are increasingly being pulled into the crossfire.
The Microsoft Intune angle
Some reports suggest attackers may have used Microsoft Intune, the device management platform used by many organisations to control laptops and mobile devices.
Posts from individuals claiming to be Stryker employees indicated that staff were told to urgently uninstall Intune, with at least one report suggesting enrolled phones had their data wiped.
If accurate, this is a sobering reminder.
Tools designed to secure and manage devices can become powerful weapons if attackers gain administrative control of them.
Any platform with broad administrative access, identity systems, endpoint management platforms, remote administration tools, becomes a high-value target.
What incidents like this usually reveal
From the outside, attacks like this look extraordinary.
But when you work in cyber security day-to-day, the underlying pattern is often familiar.
Compromised credentials.
Too much administrative access.
Attackers gaining control of management tools that were meant to protect the organisation.
The scale may be different, but the mechanics are often surprisingly similar.
The difference between a headline-making cyber incident and a quiet near-miss is often just one missing control.
What small businesses should take from this
“We’re too small to be targeted” is still the most dangerous sentence in cyber security.
Small businesses may not face nation-state attackers directly.
But they are routinely targeted by opportunistic attackers, automated attacks and criminals looking for easy entry points into supply chains.
Many of the protections that reduce risk are already defined in a framework UK organisations can implement today: Cyber Essentials.
Here are several lessons reinforced by the Stryker incident.
Secure administrative accounts with MFA
If attackers gained control of an endpoint management platform, administrative credentials were likely involved somewhere in the chain.
Every privileged account should be protected by:
Multi-factor authentication
Strict control over who has administrative access
Shared admin accounts should never exist.
Use phishing-resistant MFA
Traditional SMS-based MFA can still be bypassed through phishing or SIM-swap attacks.
Phishing-resistant authentication methods, such as hardware security keys or passkey-based authentication, significantly raise the barrier for attackers attempting to access Microsoft 365 or administrative portals.
Patch systems and applications promptly
Most attacks begin with an initial foothold.
That foothold often comes from:
Phishing emails
Malicious downloads
Exploited vulnerabilities
Unpatched operating systems and third-party applications provide attackers with the easiest route into a network.
Keeping systems updated remains one of the most effective defensive controls available.
Maintain isolated backups
A wiper attack becomes catastrophic when no clean copy of data exists.
Backups should always be:
Stored offline or in isolated environments
Protected from administrative compromise
Tested regularly to confirm they can be restored
Backups connected to the same compromised environment may not survive a destructive attack.
Apply least-privilege access
Many organisations still have far more privileged accounts than necessary.
The principle of least privilege limits how far attackers can move if a single account becomes compromised.
Reducing administrative access significantly reduces the potential blast radius of an attack.
The bigger picture
Former FBI cyber crime chief Michael Vatis recently warned that incidents like this may represent early signals of broader campaigns.
Nation-state aligned groups rarely stop with a single organisation.
They probe supply chains.
Service providers.
Small businesses connected to larger networks.
If your organisation supports sectors such as healthcare, manufacturing, education or critical services, you may already be part of someone else’s attack surface.
Cyber Essentials will not stop a nation-state attacker.
But it can make your organisation far harder to compromise than the next one.
And in an increasingly hostile cyber landscape, that difference matters.
