When Stryker Corporation was the target of a cyberattack on March 11, it appeared to be the kind of business crisis that has a tendency to get worse. A Portage, Michigan-based medical technology giant, with products in operating rooms across the world, suddenly had hackers inside its Microsoft systems. Eight lawsuits, filed by current and former employees from Colorado, Michigan, New Jersey, and Tennessee, were filed within weeks. They all essentially claimed that Stryker had failed to protect them.
By July 1, every one of those lawsuits was gone. U.S. District Judge Hala Y. Jarbou signed the dismissal order on Tuesday after the plaintiffs filed a notice of voluntary withdrawal on June 29. The case was dropped “without prejudice,” which in legal terms means it wasn’t decided on its merits and could theoretically be refiled. But watching this play out, there’s a real sense that the plaintiffs ran into a wall — and decided to walk away before hitting it harder.
The timing is important. Juan Pablo Calderon, the chief information security officer at Stryker, made a sworn declaration to the court about a week prior to the withdrawal. According to Calderon, the company’s three-month forensic investigation revealed no proof that any of the eight plaintiffs’ personal data had been accessed.
Social Security numbers, financial account details, health insurance data, driver’s license numbers — none of it, according to Stryker, was touched. Investigators only discovered business email addresses in examined files that were connected to two of the plaintiffs. That’s a significant distinction in a data breach case, where demonstrable harm is usually the foundation everything else is built on.
It’s worth stopping to consider that particular detail. The success of data breach lawsuits depends on whether actual harm occurred, or at the very least, whether harm is likely to occur. The legal foundation quickly becomes unstable in the absence of proof that private information was truly compromised. Stryker relied heavily on this, and a third-party forensic firm it hired went even farther, discovering that all eight plaintiffs’ personal information had previously been compromised in unrelated breaches dating back, in some cases, to 2008. Although that argument does not absolve Stryker of responsibility for the March attack, it does significantly undermine the claim that these workers were particularly vulnerable due to the company’s negligence.
The actual attack was not insignificant. Federal investigators later linked the intrusion to a group called Handala Hack, tied to Iran’s Ministry of Intelligence and Security. It appears that the hackers employed a malicious file intended to interfere with Stryker’s operations; this was a wiper-style attack meant to inflict harm rather than steal data covertly. Stryker consistently insisted that its hospital-facing systems and medical devices were unaffected, which, if accurate, is crucial for a business whose goods are used in operating rooms.
There’s still something unresolved about all of this. A voluntary dismissal is not a verdict, so even though the lawsuit has been dropped, Stryker hasn’t been completely vindicated. The plaintiffs may have simply decided that it wasn’t worth the expense of litigation to move forward in the absence of hard proof of personal data exposure. It’s also possible the Calderon declaration, arriving the week before the withdrawal, made the path forward look considerably harder than it had a few months ago. In any case, each party will be responsible for paying its own legal fees, which is a subtle indication of how things were going.
The Western District of Michigan’s case officially named In re Stryker Corporation Cyberattack Litigation is currently closed. There are still hackers out there. Concerns regarding corporate cybersecurity readiness still exist. Judge Jarbou’s order makes it clear that the door is still open.
