Skeleton staff return to Stryker Cork sites after Iranian-linked cyber attack hits IT systems

Skeleton staff return to Stryker’s Cork plants as engineers work to restore systems after major cyber attack

One of the Stryker plants near Carrigtwohill, Co Cork. File picture: Denis Minihane 

Only a skeleton staff will return to Stryker’s Cork sites on Friday after an Iranian-linked cyber attack infiltrated its IT systems on Wednesday.

One person working in one of the Carrigtwohill Stryker plants described the process workers are following as “painstaking and difficult”.

“How would you like to do your job if all the letters and numbers on your keyboard were suddenly replaced by Egyptian hieroglyphs?” they said.

“Some systems have been restored, but others have not, so we are working with extreme care in what is quite a precarious situation.

“Workers are doing their very best in what are very difficult circumstances, while doing absolutely everything they can to remain compliant with what are very exacting standards.” 

While concerns had been expressed by some staff about whether wages would be paid on time, is understood that payroll systems have not been affected and all payments to staff have been processed without issue.

Another Stryker employee told the Irish Examiner that there is no indication of when they will return to work.

A skeleton staff is due to work on Friday in the organisation, which employs more than 56,000 people globally.

The company’s server in Dublin was still down on Thursday evening, preventing production from restarting.

Employees whose laptops still showed only a blue screen — an indication that it had been hacked — were told to refrain from engaging any IT.

But those who had access to a functioning laptop could log on, staff were told.

Production machines were being prioritised for repair.

But progress on restoring the network was made on Wednesday night, Stryker told staff.

Help desks are being set up at all Stryker facilities to help staff regain access to computers.

'Retaliation' for attack on school

A hacktivist network called Handala claimed responsibility for the attack on a social media account believed to belong to the group.

It said that the Stryker attack was in retaliation for the “brutal attack on the Minab school” in Iran, which killed more than 175 civilians, many of them children.

The US has been blamed for the bombing.

The attack on Stryker was a wiper attack, which aims to destroy IT systems and their data. These attacks are politically, rather than financially motivated.

'No malware or ransomware' 

A spokesperson for Stryker said the company is “continuing to resolve the disruption impacting our global network, resulting from the cyber attack".

“At this time, there is no indication of malware or ransomware and we believe the situation is contained to our internal Microsoft environment only.

“Our products like Mako, Vocera, and LIFEPAK35 are fully safe to use.

“We have visibility to the orders entered before the event, and they will be shipped as soon as our system communications are restored. Any orders that have come in after the event are being examined.

"We are working to ensure our electronic ordering system is back up and running as quickly as possible.

"It is safe to communicate with Stryker employees and sales representatives by email and phone, and within your facility."