Your MFA Didn’t Fail. Your Trust Model Did.

The Stryker breach and the credential assumption nobody wants to admit out loud.

On March 11, 2026, someone logged into Stryker’s Microsoft Intune console using a valid administrator account and issued remote wipe commands to tens of thousands of Windows devices across dozens of countries.1 No malware. No exploit. No novel attack tool. The legitimate device management platform did the damage.

Handala, the Iran-linked group believed to operate under the Ministry of Intelligence and Security, claimed credit immediately.2 Stryker confirmed the incident disrupted manufacturing, order processing, and shipping globally.3 The FBI and CISA engaged at the executive level.4 Microsoft DART and Palo Alto Unit 42 were brought in for forensics.5

The first instinct in incidents like this is to ask whether MFA was configured. That framing misses the deeper structural problem. Whether MFA was absent or was bypassed by a more sophisticated technique, stolen credentials were sufficient to reach the Intune console. That is the vulnerability worth understanding.

What the evidence actually shows — as of March 18, 2026

• Confirmed: An Intune administrator account was compromised and used to create a new Global Administrator account, which issued the wipe commands.1