
On March 11, 2026, a single compromised Microsoft Intune admin account at Stryker - the $25B medical technology giant - was used to push a coordinated wipe command to every enrolled device on the company's network. Within hours, more than 200,000 servers, laptops, and mobile devices across 79 countries went dark. 50 terabytes of corporate data was exfiltrated. Offices shut down. Manufacturing and shipping stalled. Employees lost access to their own personal devices. The attack hit Q1 earnings and is still rippling through the business.
The Iran-linked Handala group didn't need novel malware. They used the same cloud management platform Stryker's IT team used every day. Compromise one admin account, own 200,000 devices. This is what machine-speed risk looks like in 2026.
In this 60-minute session, Pamela Fusco, Chief Privacy Officer at CyberBear Group and a former Fortune 500 CISO with three decades of frontline experience at Citi, Merck, Stericycle, and MetLife, walks through what actually happened at Stryker, the systemic gaps that let one credential become a global outage, and the asset intelligence framework that would have stopped it at every stage.
You'll leave with:
A clear-eyed breakdown of the Stryker attack chain - what Handala did, why traditional controls didn't catch it, and the architectural choices that turned one compromise into 200,000 wiped devices
The "blast radius" problem with centralized cloud management platforms (Intune, JAMF, Workspace ONE) and why every enterprise running them is exposed to the same risk
How an asset intelligence control plane changes the equation - full provenance on every device, every credential, every command, with anomaly detection at machine speed
A practical checklist of questions to take back to your CISO, CIO, and board this week
Who should attend: CISOs, CIOs, Chief Privacy Officers, Heads of Ethics & Compliance, Chief Risk Officers, and any executive responsible for asset, identity, or device governance in regulated industries.