March 18 - U.S. federal cyber authorities on Wednesday advised private-sector organizations to harden the security of Microsoft’s endpoint management software following a March 11 intrusion that affected medical device maker Stryker Corp.
According to the company, the March 11 incident disrupted its computer systems worldwide, producing wide-ranging business interruptions that included the company’s ability to process customer orders, manufacture products and ship finished goods. Stryker reported a global disruption to its Microsoft environment.
An Iran-linked hacker collective identifying itself as Handala has claimed responsibility for the intrusion, saying the action was in retaliation for an attack on a girls’ school in Minab, in southern Iran.
The Cybersecurity and Infrastructure Security Agency (CISA) said it has observed malicious cyber activity that targets endpoint management systems within U.S. organizations, drawing on information from the Stryker incident. In its advisory, CISA asked companies to strengthen endpoint management system configurations and to follow Microsoft’s recommended best practices for securing Microsoft Intune, the platform used to manage user access, devices and applications across enterprise environments.
CISA also stated it is coordinating with federal partners, including the Federal Bureau of Investigation, to identify any additional threats related to the activity and to determine appropriate mitigation measures. The agency’s guidance centers on configuration hardening and adoption of vendor-recommended controls for the affected management tool.
Media reporting on Wednesday indicated the cyberattack has had downstream effects in clinical settings, delaying surgeries for some patients, though Stryker has said it contained the breach. In an update issued on Tuesday, the company said it had contained the incident and that no patient-related services or connected medical products were affected. Stryker did not disclose any details on the financial implications of the disruption.
With federal agencies urging action and the vendor-recommended controls highlighted, organizations that rely on centralized endpoint management tools face an immediate operational and security decision: implement the prescribed hardening steps or continue operating with potentially exposed configurations. Federal coordination with law enforcement aims to clarify the broader threat profile and appropriate defensive responses.