Stryker US breach may have started with stolen credentials

New reporting suggests the cyberattack that disrupted medical technology giant Stryker may have begun with credentials harvested by infostealer malware rather than a software exploit.

SecurityWeek reported on March 18 that Hudson Rock CTO Alon Gal found evidence of Stryker administrator credentials in infostealer logs, along with other Microsoft service and mobile device management credentials linked to the company.

That does not amount to a confirmed forensic finding, and Stryker has not verified that attack path. In a March 11 SEC filing, the company said it had identified a cybersecurity incident affecting certain IT systems that caused a global disruption to its Microsoft environment. Stryker also said it had no indication of ransomware or malware at the time and that its investigation remained ongoing.

Evidence points to valid-account abuse

The newer reporting is notable because it offers a more specific theory for how the attackers may have gained access. SecurityWeek said earlier reports indicated the attackers may have abused Stryker’s Microsoft Intune environment after compromising an administrator account and creating a new global admin account, which was then allegedly used to wipe managed devices.

Hudson Rock’s analysis adds a possible upstream explanation: the credentials may already have been circulating in infostealer logs before the incident. Gal said the credentials associated with Stryker appeared to be months or even years old, suggesting the exposure window may have begun well before the March 11 incident.

Separate telemetry adds support, but not confirmation

A March 12 post from Lunar Cyber also said it had observed Stryker-related credentials in infostealer logs throughout much of 2025, with roughly 14 credential sets exposed, affecting Microsoft 365 and third-party portals.

That does not prove those credentials were used in the breach, but it does support the broader possibility that Stryker-related access data had been exposed before the incident became public. Stryker’s filing still says the full scope, nature, and impact of the incident remain unknown.

For now, the safest framing is that new reporting has linked the Stryker breach to potentially stolen credentials, but Stryker’s investigation is still ongoing, and the exact intrusion path has not been officially confirmed.