West Pharmaceutical ransomware steals data and disrupts drug-packaging production; operations restored
Ransomware stole West Pharmaceutical data and disrupted manufacturing and shipping of injectable-drug packaging and devices. Global operations resumed by 20 May. There is no family device update; the extent of stolen data remains unconfirmed.
Nothing for you to do on your devices: this affected West's business systems, and the company reported operations restored. If you receive a breach notification, verify it directly with West and follow the advice specific to the information involved.
What’s happening
West Pharmaceutical Services detected an intrusion on 4 May 2026. Attackers stole data and encrypted systems, and West shut systems down globally to contain the attack. The disruption affected manufacturing, receiving and shipping at a supplier of injectable-drug packaging, syringe and vial components, and drug-delivery devices. West notified law enforcement and engaged external investigators, including Palo Alto Networks Unit 42. By 20 May, West said all sites were operational again, although production was still increasing towards full capacity. Its 27 May update reported containment and mitigation of the immediate operational risk. This is a company breach, so there is no software patch for families. As of 3 November, the disclosures reviewed do not establish the types or number of stolen records, whether affected individuals were notified, whether a ransom was paid, or whether anyone was charged.
- What
- Breach
- Affects
- West Pharmaceutical Services' manufacturing, receiving, shipping and business systems
- Fixed in
- Nothing to patch
- Since
- 4 May 2026
- Closed
- 27 May 2026
Timeline
- Update
West published Unit 42's final containment assessment, reporting that the identified activity was contained and the immediate operational risk mitigated. Production was still ramping up.
- Update
West reported that manufacturing, receiving and shipping had restarted at every site and global operations were restored. It said no unauthorised activity had been observed since 5 May, while the investigation into affected data continued.
- Update
West said Unit 42's investigation indicated the identified unauthorised activity was contained. Restoration at remaining sites continued.
- Update
West's SEC filing confirmed stolen data and encrypted systems. Manufacturing, receiving and shipping had restarted at some sites, but global disruption continued without a firm recovery date.
- Made public
West publicly announced the cyberattack, saying it was investigating whether data had been affected.
- UpdateNothing to patch
West detected an intrusion and took systems offline globally to contain it. It notified law enforcement and brought in external investigators.
Sources
- Form 8-K filed 11 May 2026: material cybersecurity incidentWest Pharmaceutical Services · 11 May 2026
- Company Impact Updates: cyberattack updates through 27 MayWest Pharmaceutical Services · 27 May 2026
- Form 8-K/A: global operations restoredWest Pharmaceutical Services · 20 May 2026
- West Pharmaceutical says hackers stole data, encrypted systemsBleepingComputer · 13 May 2026
- West Pharmaceutical warns of ransomware attack impacting business operationsThe Record · 12 May 2026
- West Pharmaceutical starts restoring operations after ransomware attackCybersecurity Dive · 14 May 2026