On March 11, 2026, the Iranian-linked hacktivist group Handala compromised Stryker Corporation’s Microsoft Intune environment using stolen administrative credentials, issuing wipe commands to approximately 80,000 managed endpoints and claiming exfiltration of 50TB of data. No custom malware was used; attackers operated entirely through legitimate Intune management capabilities, making the attack difficult to detect through conventional security tooling. Any organization using cloud-based endpoint management platforms with insufficient controls on privileged access faces equivalent exposure to enterprise-scale data destruction and operational disruption.