Stryker cyberattack explained: What wiper malware is and why it’s so damaging

Malware attack

• Stryker Corp hit by malware, thousands of devices wiped
• Attack disrupted global systems, affecting up to 200,000 devices
• Handala hackers claim attack, citing geopolitical reasons

Did our AI summary help?

A cyberattack on Stryker Corporation has put the spotlight on a particularly destructive form of hacking known as a wiper malware attack. Unlike ransomware, which aims to extort money, wiper malware is designed to destroy data and cripple systems.

Here’s what it means and why cybersecurity experts consider it one of the most damaging forms of digital attack.

What is wiper malware?

Wiper malware is a type of malicious software created to permanently erase or corrupt data on a computer or network.

Once inside a system, the malware overwrites or deletes critical files, often targeting components such as the Master Boot Record (MBR) or the operating system itself. When that happens, the device may fail to start or become completely unusable.

Unlike ransomware, which encrypts data and demands payment for its release, wiper malware focuses purely on destruction rather than financial gain.

How wiper malware attacks typically happen

These attacks often begin with a standard cybersecurity breach technique. Common entry points include phishing emails that trick employees into opening infected attachments, malicious downloads or compromised websites, exploited security vulnerabilities in software or networks. Once the malware enters a system, it can spread across the network and begin deleting files, databases, and entire drives.

In the recent incident involving Stryker Corporation, investigators believe hackers deployed destructive malware that wiped thousands of devices connected to the company’s network.

What happened in the Stryker cyberattack

The cyberattack reportedly disrupted the global systems of Stryker Corporation, a major medical technology firm headquartered in Michigan.

Investigators say the cyberattack disrupted systems across the United States, Europe and Asia, leaving employees unable to access company networks or perform routine work. Thousands of devices were allegedly wiped during the attack, and reports suggest that as many as 200,000 systems and servers may have been impacted. The incident has been linked to the Handala hacker group, which claimed responsibility online and said the operation wiped data and extracted roughly 50 terabytes of information. The group reportedly described the attack as retaliation linked to geopolitical tensions, underscoring how cyberattacks are increasingly becoming tied to global conflicts.

Why wiper malware is especially dangerous

Wiper malware attacks can be significantly more damaging than ransomware because data recovery may not be possible once files are destroyed. Such attacks can lead to permanent loss of corporate data, shut down critical business operations and disrupt supply chains. They can also leave organisations struggling with long recovery timelines. In the case of Stryker Corporation, the disruption could have broader consequences for healthcare systems worldwide because the company manufactures implants, surgical equipment and hospital devices used across medical facilities.

Can companies recover from a wiper malware attack?

Recovery from a wiper malware incident largely depends on whether an organisation has secure backups of its data. Cybersecurity experts say companies typically need to reinstall operating systems on affected machines, restore data from offline or cloud backups, conduct forensic investigations and strengthen their security systems before reconnecting networks. For large organisations with global infrastructure, the recovery process can take weeks or even months.

Wiper malware in cyber warfare

Wiper malware has increasingly been used in cyber conflicts. Several strains — including CaddyWiper, HermeticWiper, IsaacWiper and FoxBlade — have been linked to cyber operations during the Russian invasion of Ukraine, where digital attacks were deployed alongside conventional military operations. These incidents highlight how destructive malware is now being used as part of broader geopolitical strategies.