GoKawiilA cyberattack that appears to have knocked tens of thousands of systems offline at medical technology company Stryker this week is a sobering reminder of the importance for organizations to have robust and tested business continuity and disaster recovery plans.
Iranian threat group Handala claimed responsibility for the attack, calling it a retribution both for a recent airstrike on a school in Iran that reportedly killed more than 160 children and for the company's alleged ties to Israel.
In a post on X, Handala claimed it had wiped some 200,000 Stryker "systems, servers and mobile devices" in addition to exfiltrating 50TB of company data. "Stryker's office in 79 countries have been forced to shut down," the group claimed. "All the acquired data is now in the hands of the free people of the world, ready to be used for the true advancement of humanity."
Stryker, a company with revenue of $25 billion, described the incident on Wednesday as a "global network disruption to its Microsoft environment," which it believed has been contained. The statement noted the company is working on understanding the true scope of the attack, adding it has business continuity plans in place for supporting customers and partners. "We are committed to transparency and will keep stakeholders informed as we know more."
Related:White House Cyber Strategy Prioritizes Offense
Stryker updated its message on Thursday to indicate that it was still working on fully restoring disrupted systems but noted that products like its robot-assisted surgical platform, its real-time communication platform for healthcare professionals, and advance life support monitor and defibrillator devices were safe to use.
Stryker did not respond immediately to a Dark Reading request for comment on Handala's claims regarding the number of impacted systems and the claimed theft of company data. However, several media outlets have reported that Stryker employees in the US and elsewhere were sent home after their systems, including mobile devices and phones that employees used at work, were reset to factory settings.
A Wake-Up Call
Security experts have been warning about retaliatory cyberattacks by Iranian threat groups against US companies and cyber assets since the US and Israel launched military operations against the country about two week ago. The wiper attack on Stryker is the first big one, but security experts predict more will follow. In a research note, Flashpoint identified several technology companies including Amazon, Google, Microsoft, Oracle, Palantir, and Nvidia as organizations that Iran's Islamic Revolutionary Guard Corps (IRGC) has threatened to attack.
Related:Software Development Practices Help Enterprises Tackle Real-Life Risks
... continue reading