How Iranian hackers pose a threat to US critical infrastructure

An Iran-linked hacking group called Handala claimed responsibility for a March 11, 2026 cyberattack on Stryker Corp., a medical device maker based in Portage, Michigan, saying the operation was retaliation for events related to the U.S./Israel-Iran conflict. The attack disrupted Stryker's Microsoft software systems, affecting order processing, manufacturing and shipping operations. The incident illustrates how state-sponsored cyber operations can quickly translate regional geopolitical tensions into disruption for U.S. organizations far from the battlefield, including those integral to critical infrastructure. U.S. agencies including the Cybersecurity and Infrastructure Security Agency have responded by publishing advisories and urging organizations to heighten vigilance, while Congress has mandated faster incident reporting—cyber incidents within 72 hours and ransomware payments within 24 hours. The attack underscores a strategic reality: attackers often prioritize gaining persistent access and building leverage over immediate destruction, creating ongoing vulnerability for downstream suppliers that support hospitals, transit systems and other essential services.