US agency asks companies to secure Microsoft tool after Stryker cyberattack

A man uses a phone next to a Microsoft logo during the 56th annual World Economic Forum (WEF) meeting, in Davos, Switzerland, January 20, 2026. (REUTERS/Romina Amato)

March 18 (Reuters) - The U.S. government on Wednesday asked companies to strengthen the security of Microsoft's endpoint management tool, after a cyberattack on medical device maker Stryker Corp last week.

The March 11 cyberattack hit Stryker's computer systems, causing widespread disruption to its business, including its ability to process orders, make products and ship them to customers. The company said it had experienced a global disruption to its Microsoft environment.

An Iran-linked hacking group called Handala claimed responsibility for the attack, saying it was in retaliation to a strike on a girls' school in Minab, southern Iran. * The Cybersecurity and Infrastructure Security Agency(CISA) said it is aware of malicious cyber activity targetingendpoint management systems of U.S. organizations, based on theStryker attack. * CISA asked companies to harden endpoint management systemconfigurations, implementing Microsoft's best practices tosecure Microsoft Intune, a tool that manages user access,devices, and applications across organizations. * CISA is coordinating with federal partners, including theFederal Bureau of Investigation, to identify additional threatsand determine mitigation actions. * Bloomberg News reported on Wednesday that the cyberattackon Stryker has delayed surgeries for some patients. * Stryker said on Tuesday that it had contained the attackand that no patient-related services or connected medicalproducts were affected, though it did not provide details on thefinancial impact.

(Reporting by Natalia Bueno Rebolledo in Mexico City; Editing by Sonia Cheema)