Stryker said a security incident affecting its Entra ID environment, servers and workstations showed no evidence of ongoing unauthorized access as of March 20, 2026, at 15:20 UTC, according to a status update from Palo Alto Networks’ Unit 42.
Unit 42 said it found no current evidence of active, uncontained or persistent unauthorized access in the Stryker environment. It also said all known indicators of compromise tied to the incident had been identified and addressed.
The incident was not described as a single-system event. Unit 42 said it reviewed endpoint forensic images, network logs and identity infrastructure, including Entra ID and Active Directory, and worked with Stryker’s technical teams on threat hunting, forensic analysis, containment and eradication.
Stryker has also brought in Microsoft to help recover its identity infrastructure. Unit 42 said Stryker reported that existing accounts had been secured, while impacted systems were either being rebuilt or restored from backups predating the known window of compromise. Systems not yet rebuilt or restored were isolated from the network.
According to the letter, Unit 42 had not identified evidence of unauthorized activity related to the incident since March 11, 2026. Today the company's shares have moved 0.36% to a price of $363.78. If you want to know more, read the company's complete 8-K report here.
