How Iran war is spilling into cyberspace

Representative image

A cyberattack that shut down thousands of laptops and phones at US medical technology company Stryker is raising new concerns about how the ongoing conflict with Iran could spread into the digital world.

Employees across the company woke up to find their devices suddenly unusable after remote systems were wiped overnight. The disruption forced the company to tell staff to disconnect all devices from its network while engineers tried to figure out what had happened.

The group claiming responsibility said the attack was carried out on behalf of Iran, the Wall Street Journal reported. If confirmed, it would mark a new phase in the conflict, where retaliation is not limited to missiles or drones but also includes attacks on companies and digital systems.

What happened inside Stryker

The problems began shortly after midnight on the US East Coast. Employees logging in for work discovered that their laptops and phones were no longer functioning properly.

Devices running Microsoft Windows had been wiped, preventing staff from accessing internal systems. According to internal messages sent to employees, the issue was widespread and affecting access to key services.

Stryker quickly told its roughly 56,000 employees to disconnect company devices from networks and avoid turning them on until further instructions.

Later in the day the company confirmed that a cyberattack had disrupted its Microsoft-based systems globally. It said it was working with Microsoft to restore affected services but warned that operations could remain disrupted for some time.

Who appears to be behind the attack

People familiar with the incident said the attackers left the logo of a group called Handala on internal company login pages.

Handala has been linked by cybersecurity researchers to Iran. The group has claimed several attacks in recent years against Israeli companies and organisations in the Gulf.

In a message posted online, the group said the attack was retaliation for a strike on an elementary school in Iran that local media reported had killed more than 160 children. US officials have said the incident is under investigation, and American forces may have been responsible.

Cybersecurity experts say groups like Handala often present themselves as independent “hacktivists,” but many appear to operate with backing from Iranian state institutions.

Why companies are often targeted in cyber conflicts

Attacks on businesses are increasingly common during geopolitical confrontations. Experts say companies are often easier targets than government or military systems, which tend to have stronger cybersecurity protections.

At the same time, disrupting a major company can create significant public attention and economic consequences.

Retired General Tim Haugh, who previously led both the US National Security Agency and US Cyber Command, said industry often becomes a natural target during conflicts because attacks on companies are visible and can create pressure without escalating into direct military retaliation.

Cybersecurity analysts say attackers sometimes focus on suppliers and infrastructure providers rather than frontline organisations. Disrupting a company that provides equipment or services to hospitals, for example, can ripple through the entire healthcare system.

How serious Iran’s cyber capabilities are

Iran has built a reputation over the past decade as an active cyber player. While its operations are generally considered less sophisticated than those of China or Russia, Iranian-linked groups have repeatedly targeted businesses and infrastructure in the US, Israel and the Middle East.

Much of this activity is believed to be carried out through proxy groups. These organisations operate publicly as activist hackers but often have links to Iran’s security services or the Islamic Revolutionary Guard Corps.

Security experts say this structure gives Tehran a degree of deniability while still allowing it to conduct disruptive operations.

What this attack could signal

The cyberattack on Stryker may be an early sign of how the current conflict could broaden beyond military operations.

Iran has already launched drones at US bases, fired rockets toward Israel and placed mines in the Strait of Hormuz, threatening global oil supplies. Cyber operations offer another way to respond without directly confronting American military forces.

For businesses, that creates a new kind of risk. Large corporations operate global digital networks that can become targets during geopolitical crises.

If cyber retaliation increases, companies far removed from the battlefield could find themselves unexpectedly caught in the middle of an international conflict.