West Pharmaceutical Services Discloses Data Theft and System Encryption
Summary
West Pharmaceutical Services disclosed that an unauthorized party exfiltrated data and encrypted some systems after an intrusion detected May 4, 2026. Shipping and manufacturing systems were partly restored; the investigation continues.
Key points
- The company said it detected an intrusion on May 4 and determined on May 7 that it had experienced a material cybersecurity attack.
- A company filing said an unauthorized party exfiltrated some data and encrypted certain systems; the data type and incident scope remain under investigation.
- West took systems offline globally, notified law enforcement, and engaged external experts, including Palo Alto Networks' Unit 42.
- Core enterprise systems supporting shipping and manufacturing were restored in part, and manufacturing had partially restarted; full restoration remained pending.
- The company had not estimated the incident's financial impact, and no ransomware group had claimed responsibility.
Article Details
- Victim Organization
- West Pharmaceutical Services
- Incident Type
- Unauthorized intrusion involving data exfiltration and encryption of certain systems
- Incident Date
- 2026-05-04
- Disclosure Date
- 2026-05-07
- Affected Records
- Unknown
- Affected Data Size
- Unknown
- Operational Impact
- Systems were taken offline globally for containment, disrupting business operations. Core enterprise systems supporting shipping and manufacturing were restored in part, and manufacturing partially restarted; full restoration had not been completed.
- Ransom Or Extortion
- No ransom demand or extortion activity was reported. No ransomware group had claimed responsibility at the time of reporting.
- Claim Status
- confirmed