---
title: "One stolen admin login wiped Stryker's devices with Intune's own button"
summary: "How a device-management console became the weapon at Stryker, what CISA asked for on 18 March, and which of seven UEM consoles document a second approver, 11 to 19 March 2026."
url: https://www.thetechbag.com/blog/stryker-intune-wipe-one-admin-login
format: Analysis
desk: "Endpoints & devices"
published: 2026-03-19
facts_checked: 2026-03-19
author: TechBag (The TechBag Journal)
tags: ["Stryker","Microsoft Intune","Multi Admin Approval","CISA","Handala","UEM","MDM","RMM","Conditional Access","privileged access","CERT-In"]
cover: https://www.thetechbag.com/blog/covers/stryker-intune-wipe-one-admin-login.png
---

# One stolen admin login wiped Stryker's devices with Intune's own button

*How a device-management console became the weapon at Stryker, what CISA asked for on 18 March, and which of seven UEM consoles document a second approver, 11 to 19 March 2026.*

Analysis · Endpoints & devices · By TechBag · Published 2026-03-19 · Facts checked 2026-03-19 · Canonical: https://www.thetechbag.com/blog/stryker-intune-wipe-one-admin-login

The short version

- On 11 March an intruder holding one Stryker administrator login turned Microsoft Intune’s own remote-wipe command on the company’s devices. Stryker told the SEC it had “no indication of ransomware or malware”. The attackers claim between nearly 80,000 and more than 200,000 devices; Stryker has published no count.[1][3][4]
- CISA’s answer on 18 March names three controls: least-privilege Intune roles, Conditional Access with phishing-resistant MFA for administrators, and Multi Admin Approval, so that a wipe waits for a second administrator.[5]
- Of seven device-management consoles we read, two documented a second person’s approval for wipes by 19 March (Intune and 42Gears SureMDM) and one a hold on mass wipes (Workspace ONE). Remote-management (RMM) tools carry the same one-login risk, as Kaseya’s customers learned in 2021.

Whatever enrols your laptops and phones can also erase them. That is the feature: when a device is lost, an administrator wipes it from the console and the device obeys. At Stryker, the console obeyed someone else. If you run Intune, Workspace ONE, Jamf or one of the Indian-built device managers, the question is not whether your antivirus would have caught it, because there was nothing to catch. It is three narrower questions: who can send a wipe to every device you own, what stops a stolen login from becoming that person, and whether your tool can make a second human say yes first.

## No malware: what was known about the Stryker wipe by 19 March

Stryker, the US medical technology company with more than 53,000 employees,[3] identified the incident on 11 March and filed with the SEC the same day. It described “a global disruption” to its Microsoft environment, said it had “no indication of ransomware or malware” and that it believed the incident was contained.[1] A day later it reported that operations “continue to be disrupted, including its order processing, manufacturing and shipping”, while saying it did not believe patient-related services or its connected products were affected.[2] Staff were told to remove the Intune Company Portal and other management apps from their personal phones.[3]

The claims came from the attackers. Handala, a group BleepingComputer describes as hacktivists linked to Iran’s Ministry of Intelligence and Security, said it had stolen 50 terabytes and wiped more than 200,000 systems, servers and mobile devices, shutting offices in 79 countries.[3] By 19 March the claim had become “nearly 80,000 devices”, wiped with “the built-in wipe command” in Intune. A source familiar with the incident told BleepingComputer the attackers worked from a new Global Administrator account, created after they compromised an existing administrator account.[4]

**Figure: Seven days from the wipe to CISA's warning, and the company never mentioned malware**

*Stryker incident: filings, claims and guidance, 11 to 19 March 2026*

| Date | Event | Detail |
| --- | --- | --- |
| 11 Mar 2026 | Devices wiped; Stryker files | 8-K: global disruption to its Microsoft environment, no indication of ransomware or malware |
| 12 Mar 2026 | Second 8-K | Order processing, manufacturing and shipping still disrupted |
| 13 Mar 2026 | Microsoft's Intune advice | Put device wipe, scripts and role changes behind a second approver |
| 18 Mar 2026 | CISA alert | Harden endpoint-management systems: least privilege, Conditional Access, Multi Admin Approval |
| 19 Mar 2026 | Global Administrator detail | Source: attackers created a new Global Administrator after taking one admin account |

Source: Stryker Form 8-K filings (11 and 12 March); BleepingComputer (11 and 19 March); Microsoft Intune Customer Success blog (13 March); CISA (18 March) · as of 19 March 2026 · The device counts are the attackers' claims and differ between reports; Stryker has not given a number.

ReportedTwo claims, no count

Both device numbers, 200,000 on 11 March and nearly 80,000 on 19 March, come from the attackers.[3][4] CISA did not attribute the attack and Stryker has not said how many devices were wiped. We treat the range as unverified and draw no chart from it.

## How a device-management console becomes the weapon

A unified endpoint management (UEM) console exists to issue commands that devices cannot refuse. Enrolment hands it that authority: install this app, run this script, apply this policy, and, for a stolen laptop, erase everything and return to factory settings. A wipe is not an exploit. The device receives a correctly signed instruction from the server it was told to trust, so endpoint protection sees an operating system resetting itself, not an intruder. That is why Stryker could find no malware and still lose its devices.

The control point, then, is not the device but the person at the console. In Intune, administrative power flows from Microsoft Entra ID roles and Intune’s own role-based access control. Microsoft’s Intune team, writing two days after the attack, put the exposure plainly: “Every privileged Intune action (Intune RBAC Role Management, device wipe, script deployment) should require strong, policy-verified sign-in, not just a password.”[6] A Global Administrator can create other administrators, which is what the source says happened.[4]

**Figure: One stolen login is enough when the console trusts whoever is signed in**

*The attack path reported at Stryker, as described up to 19 March 2026*

1. 011. One admin login takenAn existing administrator account is compromised; the method was not disclosed.
2. 022. A new Global AdministratorThe intruder creates an account of their own with the tenant’s highest role.
3. 033. Intune's wipe commandThe built-in remote wipe goes to enrolled laptops, servers and phones.
4. 044. Nothing to detectDevices reset on a legitimate instruction; the company reports no sign of malware.

Source: BleepingComputer (19 March, unnamed source and attackers' claim); Stryker Form 8-K (11 March) · as of 19 March 2026 · How the first administrator account was compromised had not been published by 19 March.

Our view

Our view: the blast radius of a device-management breach is the scope of the widest administrator role, not the quality of your EDR. A tenant in which one account can wipe every device has a single point of failure, however good everything else is. Count the accounts that can do it before you count anything else.

## CISA's three controls, and what each one takes away

CISA’s alert of 18 March, issued with input from Microsoft and Stryker, asks organisations to harden endpoint-management systems in three ways.[5] **Least privilege:** use Intune’s role-based access control so each role holds only the actions it needs, scoped to the users and devices it serves. **Phishing-resistant MFA and privileged-access hygiene:** Entra Conditional Access, risk signals and privileged-access controls so that a stolen password cannot reach the admin console. **Multi Admin Approval:** a second administrator approves high-impact changes, naming device wipes, applications, scripts, role changes and configurations.[5] Microsoft’s own advice adds time-bound roles through Privileged Identity Management, so nobody holds standing administrator rights, and a documented break-glass path for emergencies.[6]

**Figure: Each control removes one step of the attack; only the second approver stops a wipe by a valid admin**

*The Stryker attack path against CISA's recommended controls, March 2026*

One admin, one console

- A password and an ordinary sign-in reach the admin centre
- Standing Global Administrators can mint more administrators
- Any administrator can wipe every enrolled device
- The wipe runs the moment it is sent

With CISA's three controls

- Conditional Access demands phishing-resistant MFA and a compliant device
- Roles are time-bound and scoped; the helpdesk cannot wipe the whole fleet
- Role changes themselves wait for a second approver
- A wipe sits as a request until a different administrator approves it

Source: CISA alert, 18 March 2026; Microsoft Intune Customer Success blog, 13 March 2026 · as of 19 March 2026

Our view

Our view: Multi Admin Approval is the control that would have mattered most and the one with the clearest limit. Approvers are an administrator group, and a group is only as safe as whoever can change its membership. An intruder already holding Global Administrator can try to add an approver of their own. So the second approval works only alongside the first two controls: very few Global Administrators, none of them standing, all of them on phishing-resistant sign-in. Turn on approval for role changes as well as wipes, which CISA lists.[5]

## Two of seven consoles documented a second approver

CISA’s advice is written for Intune, but the risk belongs to every console that can wipe. We read the public documentation of seven device-management products in wide use globally and in India, and asked one question: by 19 March, did the vendor document a way to stop one administrator wiping devices alone?

**Microsoft Intune** did. Its Multi Admin Approval access policies extended to the retire, wipe and delete device actions by January 2025,[7] and Microsoft urged customers on 13 March to put device wipe behind a second approval.[6] **42Gears SureMDM** did too. With its Four-Eyes framework switched on, a remote-wipe job becomes a request in a “Four Eyes” tab and reaches devices only once an authorised administrator approves it;[9] 42Gears cites remote wipe and device deletion as the actions it is for.[10] **Omnissa Workspace ONE UEM** takes a different route. Wipe protection sets a threshold, a number of wipes within a number of minutes; past it, further device wipes, enterprise wipes and deletions are held “On Hold” until an administrator approves or rejects them in the wipe log and unlocks the system.[8] That is a brake on volume, not a second person: nothing in the page requires the approver to differ from the sender.

For **Jamf Pro**, **Hexnode UEM**, **ManageEngine Mobile Device Manager Plus** and **Scalefusion** we found no document dated on or before 19 March that describes either control. Hexnode’s help page has the administrator re-enter their own portal password to confirm a wipe,[11] which proves the person is signed in, the one thing a stolen login already does.

**Figure: Two of the seven consoles documented a second person's approval for a wipe**

*Device-management consoles by the wipe safeguard their documentation described, as of 19 March 2026 (7 products)*

- Second admin approves each wipe (Intune, SureMDM)2 products 29%
- Hold after a wipe threshold (Workspace ONE)1 products 14%
- None found in dated documentation4 products 57%

|  | Value (products) | Share |
| --- | --- | --- |
| Second admin approves each wipe (Intune, SureMDM) | 2 | 29% |
| Hold after a wipe threshold (Workspace ONE) | 1 | 14% |
| None found in dated documentation | 4 | 57% |

Source: Vendor documentation: Microsoft and HTMD on Intune; 42Gears; Omnissa; Jamf, Hexnode, ManageEngine and Scalefusion help pages · as of 19 March 2026 · A control is counted only if a document dated on or before 19 March 2026 describes it. 'None found' is not proof of absence; ask the vendor.

TechBag countHow TechBag counted

Seven products: Microsoft Intune, Omnissa Workspace ONE UEM, Jamf Pro, 42Gears SureMDM, Hexnode UEM, ManageEngine Mobile Device Manager Plus and Scalefusion. Counted as “second admin” if a dated vendor or practitioner document shows a wipe waiting for another administrator’s approval; “threshold” if wipes beyond a set volume are held. Re-entering one’s own password does not count. Result: 2 second admin, 1 threshold, 4 none found.

The two approaches answer different attacks. A per-wipe approval stops a single intruder at the first command but adds friction to every lost phone, which tempts teams to leave it off. A threshold leaves routine wipes alone and catches the mass event that defined Stryker, but lets through the first few devices and can be unlocked by the same hand. A buyer should want both, and should ask the vendor in writing which actions each one covers: wipe, retire, delete, and script deployment.

## The same single login runs your RMM

Remote monitoring and management (RMM) tools, the consoles IT teams and managed service providers use to patch, script and remotely control fleets, hold the same power in a different form. A script pushed to every endpoint can do what a wipe does. CISA warned in January 2023 that criminals use legitimate RMM software as a backdoor that ordinary antivirus does not flag, and that they target managed service providers and IT help desks because one provider’s access reaches many customers.[12]

**Figure: One compromised RMM product reached fewer than 60 customers and, through them, up to 1,500 businesses**

*Kaseya VSA on-premises ransomware attack, July 2021, as reported by Kaseya*

< 60

Kaseya customers compromised, all on VSA on-premises

Kaseya, July 2021

< 1,500

Downstream businesses affected

Kaseya, July 2021

1

Product affected: VSA, Kaseya's RMM

Kaseya, July 2021

Source: Kaseya, Important notice, 2 to 5 July 2021 · as of 5 July 2021 · Kaseya's case began with a flaw in VSA, not a stolen login; the point is what the console could reach once taken.

Kaseya said fewer than 60 of its customers, all running VSA on-premises, were compromised, and fewer than 1,500 downstream businesses were affected.[13] The entry point was different from Stryker’s; the multiplier was the same. Four questions carry over to any RMM: can one administrator run a script on every device without anyone else seeing it first; can roles be scoped by client and by device group; does sign-in to the console enforce phishing-resistant MFA rather than a code an attacker can relay; and does every remote command leave a log you keep outside the RMM itself.

Our view

Our view: if you hire a managed service provider, its RMM console is your device-management console, held by someone else’s staff. Ask the provider the four questions above, and ask for the answers in the contract, not the sales deck.

If you are buying this in India

**No Indian victim, the same consoles.** We found no report of Indian systems affected by the Stryker attack, and we will not invent one. The exposure is structural. Three of the seven consoles in our count come from companies based in India: 42Gears, with its Asia-Pacific headquarters in Bengaluru;[16] Scalefusion, headquartered in Pune;[15] and ManageEngine, the IT management division of Zoho Corp.[17] Of the three, 42Gears documented a second approver for wipes by 19 March.[9]

**The clock.** An intruder issuing wipes from your console is unauthorised access to IT systems, a category CERT-In’s directions of 28 April 2022 require you to report within six hours of noticing it.[14]

**What to do this week.** Count your Global Administrators and Intune Administrators and remove standing access; switch on Multi Admin Approval for wipe, retire, delete and role changes; put the admin portals behind Conditional Access with phishing-resistant MFA. On any other console, ask the vendor in writing whether a wipe can wait for a second administrator or a threshold, and put the answer in your next renewal. If you buy through a reseller, make that question part of the quote request, alongside the per-device price and 18% GST.

How we did this

Figures as of 19 March 2026

Written as of 19 March 2026: every source is dated on or before that day, or is an undated vendor page. Stryker’s statements are quoted from its Form 8-K filings of 11 and 12 March. The device counts, the 50 terabytes and the 79 countries are the attackers’ claims as BleepingComputer reported them, and the Global Administrator detail is from its unnamed source; none is confirmed by Stryker. CISA’s controls are paraphrased from its alert of 18 March. The console count reads each vendor’s documentation; a control is counted only when a document dated on or before 19 March describes it (Microsoft’s blog of 13 March and HTMD’s article of 16 January 2025 for Intune; 42Gears’ knowledge-base article updated January 2026 and its blog of 17 March; Omnissa’s page first published 5 April 2024, covering releases from 2302). For the other four we found no such dated document; undated pages cannot show what they said on 19 March, so “none found” is a statement about the record, not proof the feature is absent. RMM products were not counted. Kaseya’s figures are its own, from July 2021.

Spotted an error? Write to us; corrections are published at the foot of the piece.

Sources

1. [Stryker Corporation, Form 8-K, Item 8.01: cybersecurity incident](https://www.sec.gov/Archives/edgar/data/310764/000119312526102460/d76279d8k.htm) — 11 March 2026
2. [Stryker Corporation, Form 8-K, Item 7.01: update on the cybersecurity incident](https://www.sec.gov/Archives/edgar/data/310764/000119312526104431/d101097d8k.htm) — 12 March 2026
3. [BleepingComputer, Medtech giant Stryker offline after Iran-linked wiper malware attack (Handala's claims; staff told to remove Intune Company Portal)](https://www.bleepingcomputer.com/news/security/medtech-giant-stryker-offline-after-iran-linked-wiper-malware-attack/) — 11 March 2026
4. [BleepingComputer, CISA urges US orgs to secure Microsoft Intune systems after Stryker breach (Global Administrator account; 80,000 claim)](https://www.bleepingcomputer.com/news/security/cisa-warns-businesses-to-secure-microsoft-intune-systems-after-stryker-breach/) — 19 March 2026
5. [CISA, CISA urges endpoint management system hardening after cyberattack against US organization](https://www.cisa.gov/news-events/alerts/2026/03/18/cisa-urges-endpoint-management-system-hardening-after-cyberattack-against-us-organization) — 18 March 2026
6. [Microsoft Intune Customer Success, Best practices for securing Microsoft Intune](https://techcommunity.microsoft.com/blog/intunecustomersuccess/best-practices-for-securing-microsoft-intune/4502117) — 13 March 2026
7. [HTMD (Anoop C Nair), Secure remote actions: retire, wipe and delete with Multi Admin Approval in Intune](https://www.anoopcnair.com/actions-retire-wipe-and-delete-with-maa-intune/) — 16 January 2025
8. [Omnissa, Workspace ONE UEM documentation: Wipe Protection (releases 2302 to 2410 and SaaS)](https://docs.omnissa.com/WorkspaceONE-UEM-Managing-Devices-VSaaS/WipeProtection) — first published 5 April 2024
9. [42Gears Knowledge Base, How to initiate wipe on the device enrolled to console (Four Eyes)](https://knowledgebase.42gears.com/article/how-to-initiate-wipe-on-the-device-enrolled-to-console-four-eyes/) — updated January 2026
10. [42Gears, What is the 4 Eyes Principle and why your IT team needs it](https://www.42gears.com/blog/what-is-four-eyes-principle-mdm/) — 17 March 2026
11. [Hexnode, Wipe a device (help)](https://www.hexnode.com/mobile-device-management/help/wipe-a-device-completely-using-hexnode-mdm/) — undated page
12. [CISA, NSA and MS-ISAC, AA23-025A: Protecting against malicious use of remote monitoring and management software](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-025a) — 25 January 2023
13. [Kaseya, Important notice: VSA incident (customer and downstream counts)](https://helpdesk.kaseya.com/hc/en-gb/articles/4403440684689-Important-Notice-July-2nd-2021) — 2 to 5 July 2021
14. [CERT-In, Directions under section 70B(6) of the IT Act (six-hour reporting)](https://www.cert-in.org.in/Directions70B.jsp) — 28 April 2022
15. [Scalefusion, About us (headquarters, Pune)](https://scalefusion.com/about-us) — undated page
16. [42Gears, Contact us (APAC and Middle East headquarters, Bengaluru)](https://www.42gears.com/contact-us/) — undated page
17. [ManageEngine, Company (the enterprise IT management division of Zoho Corp)](https://www.manageengine.com/company.html) — undated page

Related on TechBag: the [UEM and MDM guide](https://www.thetechbag.com/browse/endpoint-management/uem-mdm) compares the consoles in this count; the [RMM and patch guide](https://www.thetechbag.com/browse/endpoint-management/rmm-patch) covers the tools in section 5; the [privileged access guide](https://www.thetechbag.com/browse/identity-access/privileged-access-management) covers time-bound administrator roles.

**Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.

Go deeper on TechBag

- [UEM and MDM guide](https://www.thetechbag.com/browse/endpoint-management/uem-mdm) — the device-management consoles in this count, compared
- [RMM and patch management guide](https://www.thetechbag.com/browse/endpoint-management/rmm-patch) — the remote-management tools that carry the same one-login risk
- [Privileged access management guide](https://www.thetechbag.com/browse/identity-access/privileged-access-management) — time-bound administrator roles and approval for privileged actions