An unattributed threat actor compromised Microsoft Entra ID credentials to gain authenticated access to Microsoft Intune, then used Intune’s native device wipe functionality to destroy more than 200,000 systems across 79 countries while exfiltrating approximately 50 terabytes of data. Stryker Corporation is a confirmed victim; CISA issued an alert on 2026-03-18 urging all organizations to harden endpoint management systems. The attack exploited no software vulnerability, it abused legitimate administrative tooling, meaning organizations without strong identity controls and Intune audit monitoring face the same exposure today.