West Pharmaceutical says hackers stole data, encrypted systems
Source: Bleeping Computer
Cyberattack Overview
West Pharmaceutical Services disclosed that it was the target of a cyberattack that resulted in data exfiltration and system encryption. The company detected the compromise on May 4, 2026 and determined that an unauthorized party stole data from the network.
“On May 7, 2026, West Pharmaceutical Services, Inc. determined that […] it has experienced a material cybersecurity attack, in which certain data was exfiltrated by an unauthorized party and certain systems were encrypted,” the company noted in a filing with the U.S. Securities and Exchange Commission (SEC).
Upon initial detection, West Pharmaceutical Services promptly activated its incident‑response protocols, including:
- Taking systems offline globally for containment
- Notifying law enforcement
- Engaging external cyber‑forensic experts
An investigation is ongoing to determine the exact nature, scope, and type of data stolen.
Company Background
West Pharmaceutical Services is a publicly traded, S&P 500 American pharmaceutical manufacturing company with annual revenues exceeding $3 billion and more than 10,800 employees worldwide. The firm specializes in:
- Injectable drug packaging
- Syringe and vial components
- Containment systems
- Drug delivery devices
Impact and Response
The cyberattack disrupted global business operations. The company reports that it has restored its core enterprise systems that support shipping and manufacturing, and manufacturing has been partially restarted. However:
- Complete restoration of all systems has not yet been achieved.
- No timeline for finalizing restoration has been provided.
- No estimates have been made regarding the material impact on financial results.
West Pharmaceutical Services stated that it has taken steps to mitigate the risk of dissemination of the exfiltrated data, though specific measures were not disclosed.
External Involvement
West Pharmaceutical Services engaged Palo Alto Networks’ Unit 42 for incident response, containment, and recovery, working alongside other external experts and legal counsel. No ransomware group has claimed credit for the attack at the time of writing.