When Major Vendors Get Wiped: Evaluating Client Risk After a Breach

The Stryker incident last month is a textbook reminder: even Fortune 500 companies with massive security budgets can fall to coordinated attacks. Iran-backed groups claimed responsibility for the data-wiping attack, which raises a practical question for anyone doing due diligence on clients, partners, or vendors.

How do you assess risk when a trusted partner gets breached?

Most organizations don't. They see the headline, maybe ask "are we affected," and move on. But here's the real calculus: a breach doesn't exist in isolation. It tells you something about their security posture, their incident response time, and whether they had the controls you thought they did. If Stryker (medical devices, mission-critical infrastructure) got hit by wiper malware, what does that say about their network segmentation, their access controls, their backup strategy?

For anyone managing client or vendor relationships, this is a due diligence moment:

1. How quickly did they detect it? If it took weeks, that's a red flag.

2. What systems were actually compromised? Operational tech or just administrative? That changes your risk profile.

3. How are they communicating about it? Transparency about scope and timeline matters more than the breach itself.

4. Do they have a meaningful backup and recovery plan, or are they improvising?

The incidents we read about - Stryker, the IoT botnets, the wiper attacks - they're not random. They're signals. They tell you which organizations have mature security programs and which ones don't. Most companies caught in these attacks had basic controls gaps: unpatched systems, poor network segmentation, weak access management, or no isolated backups.

If you're evaluating clients or partners, a breach is data. Use it. Ask the hard questions. The ones with solid processes will have answers. The ones that don't... well, that's your signal to reassess.

Stay skeptical.