When Cyber War Targets Healthcare – The Moral Collapse Behind Iran’s Digital Proxies

As an extended thought exercise from my earlier piece on the digital risk from smart city infrastructure in kinetic warfare scenarios, Iran’s expanding use of cyber operations against such civilian infrastructure represents not merely validation of that hypothesis or even just an escalation in conflict but I believe also a profound erosion of moral boundaries in warfare. Referencing morality may sound a bit hollow when war is all about killing but tolerate my thought process for a few minutes.

Groups such as Handala who are widely assessed by cybersecurity researchers and now formally linked by the United States to Iranian state intelligence, illustrate how ‘hacktivism’ has become a thin veil for state sponsored disruption.

The targeting of healthcare supply chains is particularly egregious. The cyberattack on Stryker, a global medical technology provider embedded in hospital ecosystems worldwide, caused widespread operational disruption, placing healthcare systems on alert and introducing potential downstream risks to patient care. This is not abstract digital skirmishing; it is interference with systems that underpin surgery, diagnostics and life-saving treatment. The moral line is clear, when cyber operations threaten the continuity of care, they cease to be strategic acts and become endangerment of civilian life.

Such actions contravene long-established principles of proportionality and distinction that underpin both kinetic and non-kinetic conflict. Even in war, there remains an expectation codified in international humanitarian norms that civilian infrastructure, particularly healthcare, is protected. The deliberate or reckless targeting of these systems signals either disregard for these norms or a calculated willingness to exploit their absence in cyberspace. The Red Cross and recognised such agents of critical care are well known as being respected on the battlefield and NOT targeted deliberately. 

Equally troubling is the broader ecosystem that flourishes in this ambiguity. Iran-linked groups like Handala operate within a constellation of actors blending espionage, coercion and spectacle, conducting hack-and-leak campaigns, destructive wiping attacks and psychological operations. Around them, less disciplined actors attach themselves to the conflict narrative, using geopolitical tension as cover for opportunism, notoriety or financial gain.

This convergence of state backed capability and opportunistic cyber aggression creates a moral hazard, a boundary Russia has been pushing for some time so Iran is not unique in this. Conflict becomes not only a theatre for national strategy but a marketplace for self-aggrandisement.

The consequence is stark. When cyber warfare normalises attacks on civilian lifelines, it undermines the very fabric of trust that modern societies depend upon. The question is no longer whether such actions are effective but whether, if left unchecked, they redefine the acceptable limits of conflict itself.