Ransomware Had a Playbook. Wiper Malware Throws It Out.
Most executives have mentally prepared for ransomware. Pay or negotiate. Restore from backups. Deal with the PR fallout. It is a terrible situation, but at least the shape of it is familiar at this point. What happened to Stryker on March 11th is different in a way that should change how every organization thinks about its threat model. The attackers did not encrypt the data and demand a payment. They simply destroyed it.
Stryker is not a small company. It is a global medical technology giant with operations in dozens of countries. Iranian-linked hackers using wiper malware hit its Cork, Ireland headquarters hard enough to knock thousands of employees off their systems entirely. Microsoft engineers were brought in. The investigation is ongoing. And the data that was erased is not coming back. There is no key to decrypt. There is no negotiation to have. It is gone.
When the goal shifts from extortion to destruction, the entire incident response playbook changes. Most organizations are not prepared for that shift.
What Wiper Malware Actually Does
Ransomware encrypts your data and holds it hostage. Wiper malware does not bother with the hostage part. It overwrites data at a low level, making recovery technically impossible in many cases. The attackers linked to the Stryker breach, a pro-Palestinian hacktivist group called Handala with documented ties to the Iranian regime, have used this approach before. Their goal is not financial. It is operational disruption and, in some cases, making a political statement through destruction.
The financial calculus most boards have run on cyber risk does not account for this. Cyber insurance was designed for scenarios where some form of recovery is possible. Business continuity and backup strategies both assume there is something left to work with. If wiper malware has been sitting in your environment long enough to reach your backup infrastructure before it fires, those plans do not apply anymore. You are rebuilding from nothing.
The attack on Stryker was not opportunistic. Medical technology companies are high-value targets for state-linked actors because disrupting them causes harm that goes well beyond the company itself. Device supply chains, clinical systems, surgical equipment software. When a company like Stryker loses operational capability, the downstream effects touch hospitals and patients. That is exactly what certain threat actors want.
Why Your Current Security Posture May Not Be Enough
Defenses built primarily around perimeter security and endpoint detection are not designed to stop a patient, well-resourced threat actor who is willing to spend weeks or months inside your environment before activating a payload. That is the model state-linked groups operate on. They are not smash-and-grab. They are reconnaissance and positioning. By the time the wiper deploys, they often know your environment better than your own IT team does.
The organizations that fare best against this threat class are not necessarily the ones with the biggest security budgets. What they tend to have is active threat hunting rather than purely reactive monitoring, backup infrastructure that is genuinely isolated from production and actually tested, and incident response plans that have been drilled rather than just documented. The harder problem is the people question. Having analysts who can recognize something wrong in your environment before an alert fires is a different capability than buying another platform. Most executives underestimate how much that distinction matters until they are in the middle of an incident.
The Talent Side of This Problem
Wiper attacks expose something that has been true for years but is harder to ignore after an incident like Stryker. A lot of organizations have security infrastructure without having enough security expertise. Tools cannot substitute for people who understand how to use them. Threat hunting requires analysts who know what normal looks like in your environment and can recognize when something is off. That is a skilled human judgment call, not an automated alert.
The security talent shortage is real and it shows up in readiness. Organizations that have put real resources into developing their people, through certifications, hands-on training, career paths that give analysts a reason to stay, tend to outperform those that lean on tooling. Certification is part of that picture because it creates a verifiable baseline, but the question worth asking is whether your team could actually find a wiper that has been dormant in your network for six weeks. That is the real test, and it is a harder one than most organizations want to sit with.
State-linked actors are not going away. The geopolitical conditions driving groups like Handala to target Western companies are not improving in the near term. Healthcare and critical infrastructure will remain high on their list. Every organization operating at scale needs to reckon honestly with whether its security posture was built for the threat environment of 2019 or the one that exists right now.