VULNpocalypse
InformationalBreach / campaignMonitoring

Stryker discloses cybersecurity incident reference in SEC 8-K earnings filing

Stryker says in a Q3 2026 SEC 8-K exhibit that a cybersecurity incident was first reported March 11, 2026; watch for official Stryker notices.

Published
Exploitation
No, not confirmed: the filing only names a cybersecurity incident first reported on March 11, 2026 and gives no detail on cause or impact

What happened

Stryker refers to a cybersecurity incident in its third quarter 2026 earnings release. The release was filed as Exhibit 99.1 on SEC EDGAR on October 29, 2026 (SEC EDGAR).

The only cyber reference appears in the “Caution Concerning Forward-Looking Statements” section. That section lists among its risks “breaches, failures or other disruptions of our or our vendors’ or customers’ information technology systems or products resulting from cyber-attack, data leakage, unauthorized access or theft, including the cybersecurity incident first reported on March 11, 2026” (SEC EDGAR).

This exhibit does not describe the incident. The following are not confirmed in the source:

  • the nature of the incident
  • how access was gained
  • which systems or products were involved
  • whether any data was taken, and if so what kind and how much
  • who was responsible
  • whether customers or patients are affected

The March 11, 2026 report itself is not among the sources provided.

Am I affected?

Not confirmed. The filing does not say whether any customers, vendors, products or data were affected (SEC EDGAR).

What to do now

  1. Treat the filing as confirming only that Stryker counts a cybersecurity incident, first reported on March 11, 2026, among its disclosed risks (SEC EDGAR).
  2. If you are a Stryker customer or vendor, follow official communications from Stryker for any guidance specific to your organisation. This filing gives none.
  3. Do not act on third-party claims about scope, data or attribution unless Stryker or an official source confirms them.

Sources