Stryker Hit by Unprecedented 12-Petabyte Data Wipe Listed by handala Ransomware Group: What Was Exposed & What To Do
Stryker disclosed on March 16, 2026 that the handala ransomware group had listed an unprecedented 12-petabyte data wipe targeting the company, with internal files reportedly exfiltrated. Individuals who may have been impacted are advised to review any notifications from Stryker and consider protective steps such as monitoring accounts and changing passwords.
What happened
The listing appeared on March 16, 2026. The group described a swift attack that reached deep layers of the network and stated it had exfiltrated internal files. Public information does not include a confirmed count of records, a timeline of access, or independent verification that the files were removed. The headline reference to a 12-petabyte data wipe originates from the group’s claim; no separate confirmation of volume or method has been released.
Inside handala
Handala is a ransomware operator that public reporting has linked to repeated claims of network intrusions across multiple sectors. The group typically publicises operations on its leak site and frames them as demonstrations of access. In this instance the group asserts it penetrated Stryker’s systems, but the claim rests solely on the listing itself. Prior activity attributed to the same actor has involved similar announcements followed by selective release of material, though the pattern does not establish what occurred in any single case.
Who is Stryker?
Stryker is a medical-technology company whose products and services are used in hospitals and clinics. Organisations of this type routinely maintain records that include employee information, supplier details, internal communications, and technical documentation related to devices and procedures. A breach at such a firm can affect both operational continuity and the handling of sensitive material that supports patient care, even when the precise contents of any exfiltration remain unconfirmed.
What data was at risk
The only data type named in the available information is “internal files exfiltrated in ransomware attack.” No inventory of specific categories, file counts, or personal identifiers has been published. Companies in this sector commonly store personnel records, device design documents, regulatory submissions, and business correspondence; whether any of these were among the claimed files is not confirmed.
What's at stake
Individuals whose information appears in internal files could face follow-on risks such as targeted phishing or misuse of credentials if those files contain contact details or account references. For the organisation, the immediate concerns are operational disruption and the cost of investigation and remediation. Because the scale and nature of the material remain undisclosed, the concrete consequences for any one person cannot yet be assessed.
Were you affected?
Begin by monitoring official statements from Stryker for any notification process. Individuals can also enter their email address into a free public breach-exposure scanner to see whether it appears in previously published data sets. If personal records are later confirmed as exposed, standard protective steps include changing passwords, enabling multi-factor authentication, and reviewing financial and medical accounts for unusual activity.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
UFP Technologies Listed by payoutsking Ransomware GroupNorth Country Business Products Breached: 2,680 POS Terminals Disabled Nationwide Listed by handala Ransomware GroupIranWire Listed by handala Ransomware Group4 Terabytes Wiped—Good Food Store Shut Down After Major Cyberattack Listed by handala Ransomware GroupLatest breaches
Verified breach
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.