{"id":"west-pharmaceutical-ransomware-attack-may-2026","category":"breach","status":"closed","title":"West Pharmaceutical ransomware steals data and disrupts drug-packaging production; operations restored","tldr":"Ransomware stole West Pharmaceutical data and disrupted manufacturing and shipping of injectable-drug packaging and devices. Global operations resumed by 20 May. There is no family device update; the extent of stolen data remains unconfirmed.","summary":"West Pharmaceutical Services detected an intrusion on 4 May 2026. Attackers stole data and encrypted systems, and West shut systems down globally to contain the attack. The disruption affected manufacturing, receiving and shipping at a supplier of injectable-drug packaging, syringe and vial components, and drug-delivery devices. West notified law enforcement and engaged external investigators, including Palo Alto Networks Unit 42. By 20 May, West said all sites were operational again, although production was still increasing towards full capacity. Its 27 May update reported containment and mitigation of the immediate operational risk. This is a company breach, so there is no software patch for families. As of 3 November, the disclosures reviewed do not establish the types or number of stolen records, whether affected individuals were notified, whether a ransom was paid, or whether anyone was charged.","action":"Nothing for you to do on your devices: this affected West's business systems, and the company reported operations restored. If you receive a breach notification, verify it directly with West and follow the advice specific to the information involved.","product":"West Pharmaceutical Services' manufacturing, receiving, shipping and business systems","audience":"work","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["west-pharmaceutical","ransomware","data-breach","manufacturing","healthcare"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"Form 8-K filed 11 May 2026: material cybersecurity incident","url":"https://investor.westpharma.com/static-files/4f5c542b-a2e7-44bc-bb1d-8d0463dcce34","by":"West Pharmaceutical Services","date":"2026-05-11"},{"kind":"advisory","title":"Company Impact Updates: cyberattack updates through 27 May","url":"https://www.westpharma.com/support/cyberattack-updates","by":"West Pharmaceutical Services","date":"2026-05-27"},{"kind":"advisory","title":"Form 8-K/A: global operations restored","url":"https://www.sec.gov/Archives/edgar/data/105770/000010577026000077/wst-20260507.htm","by":"West Pharmaceutical Services","date":"2026-05-20"},{"kind":"news","title":"West Pharmaceutical says hackers stole data, encrypted systems","url":"https://www.bleepingcomputer.com/news/security/west-pharmaceutical-says-hackers-stole-data-encrypted-systems/amp/","by":"BleepingComputer","date":"2026-05-13"},{"kind":"news","title":"West Pharmaceutical warns of ransomware attack impacting business operations","url":"https://therecord.media/west-pharmaceutical-warns-of-ransomware-attack-impacting-operations","by":"The Record","date":"2026-05-12"},{"kind":"news","title":"West Pharmaceutical starts restoring operations after ransomware attack","url":"https://www.cybersecuritydive.com/news/west-pharmaceutical-restoring-operations-ransomware-attack/820250/","by":"Cybersecurity Dive","date":"2026-05-14"}],"started":"2026-05-04","closed":"2026-05-27","created":"2026-11-03T21:25:10.358Z","updated":"2026-11-03T21:25:10.358Z","cve_notes":[],"timeline":[{"at":"2026-05-27","added":"2026-11-03T21:16:05.524Z","kind":"other","text":"West published Unit 42's final containment assessment, reporting that the identified activity was contained and the immediate operational risk mitigated. Production was still ramping up.","url":"https://www.westpharma.com/support/cyberattack-updates","by":"West Pharmaceutical Services","patch":null},{"at":"2026-05-20","added":"2026-11-03T21:16:05.524Z","kind":"other","text":"West reported that manufacturing, receiving and shipping had restarted at every site and global operations were restored. It said no unauthorised activity had been observed since 5 May, while the investigation into affected data continued.","url":"https://www.sec.gov/Archives/edgar/data/105770/000010577026000077/wst-20260507.htm","by":"West Pharmaceutical Services","patch":null},{"at":"2026-05-13","added":"2026-11-03T21:16:05.524Z","kind":"other","text":"West said Unit 42's investigation indicated the identified unauthorised activity was contained. Restoration at remaining sites continued.","url":"https://www.westpharma.com/support/cyberattack-updates","by":"West Pharmaceutical Services","patch":null},{"at":"2026-05-11","added":"2026-11-03T21:16:05.524Z","kind":"other","text":"West's SEC filing confirmed stolen data and encrypted systems. Manufacturing, receiving and shipping had restarted at some sites, but global disruption continued without a firm recovery date.","url":"https://investor.westpharma.com/static-files/4f5c542b-a2e7-44bc-bb1d-8d0463dcce34","by":"West Pharmaceutical Services","patch":null},{"at":"2026-05-07","added":"2026-11-03T21:16:05.524Z","kind":"disclosed","text":"West publicly announced the cyberattack, saying it was investigating whether data had been affected.","url":"https://www.westpharma.com/support/cyberattack-updates","by":"West Pharmaceutical Services","patch":null},{"at":"2026-05-04","added":"2026-11-03T21:16:05.524Z","kind":"other","text":"West detected an intrusion and took systems offline globally to contain it. It notified law enforcement and brought in external investigators.","url":"https://investor.westpharma.com/static-files/4f5c542b-a2e7-44bc-bb1d-8d0463dcce34","by":"West Pharmaceutical Services","patch":"na"}],"url":"https://hard.fyi/live/west-pharmaceutical-ransomware-attack-may-2026/","json":"https://hard.fyi/api/live?id=west-pharmaceutical-ransomware-attack-may-2026"}