Iran-linked hacktivists claim to have wiped systems at Stryker

The Iran-linked hacktivist group Handala has claimed responsibility for an attack on US medical technology company Stryker. According to reports, the incident affected Microsoft-based services used by employees, and parts of the company's global operations were disrupted while systems were taken offline and restored. The group claims to have wiped a large number of systems and exfiltrated sensitive data, though these claims have not been independently confirmed. Stryker states the disruption was limited to internal systems and that investigations are ongoing.

What this means for your business

Politically motivated hacktivists pick targets for symbolic value rather than where the money is, and wiping leaves no option to pay your way out. Norwegian organisations in healthcare and other critical supply should note that the downtime here came from systems having to be taken offline and rebuilt. In that case it is your recovery capability, not your negotiating position, that decides how long you are out of service.

Berigo recommends

• Test restoration from backup in practice, with a stopwatch, and ensure at least one copy is unreachable from the production network.
• Document how critical deliveries are maintained manually while IT systems are down.
• Review who holds rights to delete or reinstall systems at scale, and reduce that number.
• Put incident preparedness on the board agenda as a business risk, not an IT matter.

Source

• zetter-zeroday.com