CISA warns firms to lock down Microsoft Intune after Stryker device wipe

Thousands of employee devices at medical technology company Stryker were remotely wiped after attackers gained access to the firm’s Microsoft Intune environment, prompting a new warning from the US Cybersecurity and Infrastructure Security Agency. According to TechCrunch, the company said the incident caused “global disruption” to its network, leaving ordering, supply and shipping systems offline even after core medical devices remained operational.

The detail that matters is not that this was “AI” or generic “cyberwar,” but that a single administrative control plane can turn routine IT management into a fleet-wide kill switch. Intune is designed to let companies centrally configure laptops and phones, enforce policies, and—crucially—wipe devices. Once attackers obtain administrator-level access, the cost of harm scales with the size of the organisation’s device estate: tens of thousands of endpoints can be bricked in minutes without deploying ransomware or malware. CISA’s guidance, as reported by TechCrunch, focuses on putting friction back into those high-impact actions: requiring a second administrator’s approval for sensitive changes, and tightening which accounts can initiate wipes.

This is the quiet tradeoff of modern endpoint management. Centralisation lowers day-to-day operating costs—fewer hands on keyboards, fewer local exceptions, faster rollouts—but it also concentrates risk. The “blast radius” of a compromised admin credential is no longer a department; it can be the entire company. Organisations that treat their management plane as just another SaaS dashboard end up discovering, during an incident, that recovery is also centralised: if the same identity system and admin tooling are unavailable, the path back to a working fleet narrows.

Mitigations exist, but they tend to be unpopular because they slow down the very workflows centralisation was meant to speed up. Separate tenants or segmented device groups reduce the maximum damage a single account can do. “Break-glass” accounts—kept offline, tightly monitored, and used only for emergencies—restore some out-of-band control when the main identity layer is compromised. Harder role-based access control, conditional access policies, and explicit separation between administrators who can manage compliance settings and those who can wipe devices all reduce the chance that one stolen credential becomes a mass event.

Stryker has not provided a public timeline for full recovery. The incident shows how a tool built to make corporate IT more efficient can, in the wrong hands, make outages more uniform.

According to TechCrunch, the attackers did not need ransomware to halt operations; they used the management console the company already trusted.