Cork-based Stryker hit with cyber attack linked to Iranian-backed group 

A global medical technology company — with up to 5,000 employees in Ireland and headquartered in Cork has been crippled by a cyber attack suspected of being carried out by an Iranian-backed group.

The Echo understands that Wednesday's attack on Stryker is known as a “wiper” attack, in which the data on the targeted IT system is “wiped out” and cannot be retrieved.

The National Cyber Security Centre in Dublin has been informed of the incident and is understood to be responding.

A wiper attack is considered a very serious type of cyber-attack, where extortion is not the purpose and is seen as a politically-motivated attack, fuelled by a hostile regime.

Multiple sources have said that systems in the Cork headquarters have been “shut down” and that Stryker devices held by employees have been wiped out.

The login pages coming up on these devices have been defaced with the Handala logo.

Handala Hack is linked to the Iranian regime, which is currently engaged in military and economic warfare in retaliation for the US and Israeli bombardment of the country.

This shutdown is having a detrimental financial impact on the company as it effectively disables the technology used to manufacture Stryker’s range of medical products and devices. 

The focus will be to try and restore production to any machines that were put out of action as a result of the attack. It is understood that some machines used to manufacture Stryker's medical devices are still in operation in Cork, however, it is not known how long they will continue operating for.

Israeli media report that Handala Hack has also claimed to have broken into the website of the Academy of the Hebrew Language.

International technology media reports that the group has compromised multiple oil and gas installations across Israel, Jordan, and Saudi Arabia.

The Israeli National Cyber Directorate has said it was trying to intercept a wave of Iranian cyber attacks on Israeli civilian companies in recent days.

'Phones wiped'

It is understood that Stryker may have been targeted over business links with Israel, with one worker saying the attack is "very significant".

"Anything connected to the network is down," they said.

"All support staff, administrative staff and engineers have been sent home.

"And anyone with Outlook on their personal phones had their phones wiped."

Staff are now communicating through WhatsApp groups for any updates on when they can return to work.

A message sent to staff today warned them not to connect to the Stryker network through any device, including mobile apps like Microsoft's Outlook and Teams until cleared to do so.

“We know that the situation creates uncertainty. Please know that our teams are actively addressing the issue with security experts and law enforcement,” the statement said.

“Our people and our sites are safe. We are focused on our customers and the patients they serve, while ensuring the continuity of their operations and our own.

“Please stay focused and follow guidance from your leaders while we work to restore systems.”

A spokesperson for Stryker said the company is "experiencing a global network disruption affecting the Windows environment". 

"Our teams are actively working to restore systems and operations as quickly as possible. Stryker has business continuity measures in place, and we’re committed to continuing to serve our customers," the spokesperson said.

Ireland is now home to Stryker’s largest hub outside of the US. It has six manufacturing facilities here, along with three innovation centres located in Cork, Belfast, and Limerick. Stryker has 5,500 workers in Ireland, some 4,000 of them based in Cork.

The Handala group uses a cartoon image of a little Palestinian boy, a symbol associated with Palestinian resistance.

The character was created in 1969 by Palestinian newspaper cartoonist Naji al-Ali and has since been widely used by the Palestinian national movement.