Ransomware · 124 days ago
A ransomware incident at West Pharmaceutical Services turned into an operational outage, not just a data-theft case. The company took affected on-prem systems offline globally, and shipping, receiving, and manufacturing were disrupted across sites. Patch-and-recover logic misses the real problem here: even partial restoration can leave supply and production staggered for days or longer.
West says the May 4 incident involved data exfiltration before file-encrypting ransomware was deployed. It brought in Palo Alto Networks Unit 42, notified law enforcement, and said core enterprise systems are back, with some shipping, receiving, and manufacturing restarted and other sites still being restored. No final restoration timeline has been set, and the company has not said what data was taken or named the ransomware group.
For downstream pharma, med-device, and manufacturing customers, the risk is not just lost records. A supplier outage at this level can delay shipments and create secondary inventory pressure long after the initial intrusion is contained.
4 sources covering this story
West Pharmaceutical starts restoring operations after ransomware attack
The company confirmed data was stolen and encrypted by the attackers.
West Pharmaceutical says hackers stole data, encrypted systems
West Pharmaceutical Services disclosed that it was the target of a cyberattack that resulted in data exfiltration and system encryption.
The Record from Recorded Future
West Pharmaceutical warns of ransomware attack impacting business operations
West Pharmaceutical Services filed a report with the Securities and Exchange Commission (SEC) on Monday evening warning customers that a hacker breached the company network on May 4, stole data and encrypted systems.
West Pharmaceutical Services Hit by Disruptive Ransomware Attack
The company took systems offline globally after hackers exfiltrated data and deployed file-encrypting ransomware.
Part of the PlainSec briefing for 2026-05-15