The tool that manages everything can erase everything.

Last Wednesday, March 11, employees of Stryker, the Michigan medical technology company, reported from the United States, Ireland, Costa Rica and Australia that their company laptops and phones had been remotely wiped in the middle of the night. Some who had enrolled personal phones for work lost their own data too. The company's sign-in page showed the logo of Handala, a group that security researchers link to Iran's Ministry of Intelligence and Security, which claimed the attack and framed it as retaliation for a US missile strike in Iran. Some locations went back to "pen and paper."²¹

What makes the incident worth every IT leader's attention is how it appears to have been done. A source familiar with the attack told BleepingComputer that the attacker compromised an administrator account, created a new Global Administrator account, and used the wipe command in Microsoft Intune, the cloud service that manages the company's devices, to erase nearly 80,000 of them between 5:00 and 8:00 a.m. UTC.⁶ On the day of the attack, an anonymous source told KrebsOnSecurity that Intune's remote wipe had been used.¹ Stryker has not described the mechanism. It says the attack was confined to its internal Microsoft environment, that it was not ransomware, and that it has found no evidence of malware.⁴ Handala claims it wiped more than 200,000 systems and took 50 terabytes of data. Those are the attackers' figures, and BleepingComputer reports that investigators found no indication that data was taken.²⁶

My argument is that the attack exposes a gap most organizations have never measured: the gap between what one admin can do and what one admin should do alone. A management console exists so that one person can fix every device quickly. The same design lets one stolen identity break every device quickly. How far one action can reach, its blast radius, is not a property of the tool. It is a set of choices about roles, scope and approval. Two things I am not claiming. I don't know how the account was compromised; that has not been reported, and guessing would be unfair. And this is not an argument against Intune or cloud management. Any console strong enough to be useful is strong enough to be dangerous.

No malware needed

Classic destructive attacks bring their own weapon. Shamoon, which hit Saudi Aramco in 2012, and ZeroCleare, reported in 2019, were malicious software written to destroy data, and both have been linked to Iran, Shamoon less conclusively. Ars Technica noted last week that this case may not fit the pattern, because Stryker had found no malware and early reports pointed to Intune.³ If the reporting holds, the attacker did not need to write, smuggle or hide anything. The wipe command is a feature. It travels through the same trusted channel that delivers security settings, and every device obeyed because obeying is its job. Endpoint protection is built to catch software that misbehaves. It has much less to say when a valid administrator account issues a valid command.

Blast radius is a design choice

Few organizations ever decide that one account should be able to erase every laptop and phone they own. It accumulates. Global Administrator rights are granted for a project and never removed. Admin roles are created without a scope, so a role meant for one region reaches devices in every region. Bulk actions carry no more friction than single ones, so wiping the whole fleet takes about as many clicks as wiping one lost laptop. Personal phones are enrolled for convenience and sit under the same console as company laptops. Each choice is reasonable on the day it is made. Together they define the worst thing one compromised identity can do, and most organizations have never written that sentence down. I don't know which of these held at Stryker, and the reporting does not say.

Two keys for the big doors

On March 14, three days after the attack, Microsoft published guidance that reads as a checklist for narrowing the radius.⁵ Design admin roles around real jobs, not blanket rights, and use scope tags so an admin reaches only one region's or one team's devices. Keep Global Administrator out of daily work. Replace standing privilege with time-limited elevation. Require phishing-resistant sign-in and Conditional Access for admin portals. And turn on Multi Admin Approval, so a second authorized admin must approve selected changes, starting with device wipes, script deployment and changes to admin roles. In Microsoft's words, it reduces the risk that "a single action can result in tenant-wide impact."⁵

The cost is real, and it falls at the worst moment. A second approver slows the emergency fix: the urgent script at 2 a.m., the stolen laptop that should be wiped before anyone opens it. Microsoft's answer is to define who can approve and how fast, and to document a break-glass path with an explicit review afterward.⁵ That path has to be narrow, watched and rare. A break-glass account anyone can use when they are in a hurry is just another Global Administrator.

The business runs on the console

The second lesson is about what the console is connected to. Stryker's updates describe damage not to IT but to the business. On March 12 the company said the incident had disrupted order processing, manufacturing and shipping. By Sunday it was still bringing its electronic ordering systems back online, and its sales representatives were working with customers and distributors on manual orders where that option existed.⁴ Recovery plans are usually written for a lost data center or a ransomware lockout. Fewer are written for the day the management plane turns hostile: when the tool you would use to rebuild devices is the tool that erased them, and the identities you would use to sign in are the ones you can no longer trust.

Objections, considered

Admins have to be trusted with power anyway. They do, and the danger is usually not the person but the account. A second approval is not a judgment of anyone's character. It assumes that any single credential can be stolen, which is the safer assumption.

An attacker with the highest role can loosen the rules. Possibly, which is why the highest role needs the fewest holders and the strongest sign-in, and why an alert on a new Global Administrator matters as much as any approval rule. No control makes the radius zero. The aim is that the largest actions need more than one stolen key.

The worst thing one stolen account can do is a number you get to choose.

Three questions for the next access review

• Which single account could change every device? Name it, count the people who hold it, and ask whether any of them use it for daily work.
• Which actions need two people? Start with wiping devices, deploying scripts and changing admin roles, and decide how the second approval works at 2 a.m.
• If the console were the attacker, how would we take an order? Write down the manual path for the process customers would notice first, and test it.

Back to the sign-in page with someone else's logo on it. According to the reporting so far, nothing behind that page required an exploit. It required one identity that was allowed to do everything, and a console that did what it was told. The console will always do what it is told. What is left to decide is how many people have to tell it.