West Pharmaceutical Services Says Ransomware Attack Exfiltrated Data
Summary
West Pharmaceutical Services says a May 4 ransomware attack disrupted global operations and exfiltrated data before encrypting files. Some systems and processes have been restored, while the data impact and full restoration timeline remain undetermined.
Key points
- The company said the attack occurred May 4 and led it to shut down and isolate affected on-premises infrastructure.
- The shutdown disrupted global business operations; shipping, receiving, and manufacturing have restarted at some sites.
- West Pharmaceutical Services said attackers exfiltrated data before deploying file-encrypting ransomware; the affected data’s extent and type remain under investigation.
- The company engaged Palo Alto Networks’ Unit 42 for containment, restoration, and investigation, and notified law enforcement.
- Core enterprise systems have been restored, but restoration at remaining sites is ongoing and a completion timeline has not been set.
- The company said it had not determined whether the incident would materially affect its financial results; no ransomware group was known to have claimed responsibility.
Article Details
- Victim Organization
- West Pharmaceutical Services
- Incident Type
- Ransomware attack involving data exfiltration followed by deployment of file-encrypting ransomware
- Operational Impact
- The company proactively shut down and isolated affected on-premise infrastructure, disrupting business operations globally. Core enterprise systems were restored, and shipping, receiving, and manufacturing processes restarted at some sites; restoration at remaining sites was still in progress.
- Ransom Or Extortion
- The company said it took steps to mitigate the risk of dissemination of exfiltrated data, which the article says might imply negotiation with the attackers. SecurityWeek reported seeing no known ransomware group claim responsibility and suggested a ransom might have been paid; neither negotiation nor payment was confirmed.
- Claim Status
- confirmed