What happened
West Pharmaceutical Services, a US maker of packaging and delivery components for injectable drugs (vials, stoppers, plungers), was hit in May 2026 by a ransomware attack that stole data and encrypted systems.
The timeline, according to the company's SEC filings:
- May 4: intrusion detected. The company took systems offline globally to contain it, notified law enforcement and brought in experts, including Palo Alto Networks' Unit 42.
- May 5: last observed unauthorized activity.
- May 7: the company determined it was a material incident, with data exfiltrated and systems encrypted.
- May 11: SEC filing (Form 8-K). Operations still partly down.
- May 20: update (8-K/A) saying the company is fully operational across manufacturing, supply chain and commercial sites.
West says there is no evidence its email was compromised or of attacks on customers, suppliers or employees. It also says the incident isn't expected to materially affect its 2026 financial guidance. The investigation into what data was taken was ongoing. The attackers have not been publicly confirmed.
Why it matters
West is a key link in the pharmaceutical supply chain: many vaccines and injectable drugs depend on its components. Even a few days of downtime at a company like this can ripple into customers' production worldwide.
It also shows modern ransomware's double play: steal data first, then encrypt, to pressure the victim two ways.
Lessons for businesses
- Have a response plan ready: West isolated systems the same day. That only works with a plan and contacts set up in advance.
- Isolated, tested backups, so you can restore without paying.
- Network segmentation, so an attack on office IT doesn't reach the factory floor.
- Monitor outbound data: large transfers out are often the first sign of theft.
- Map critical suppliers: if one goes down, what's plan B?
Sources
- SEC, Form 8-K West Pharmaceutical (11/05/2026): https://www.sec.gov/Archives/edgar/data/105770/000010577026000068/wst-20260507.htm
- OTC Markets, Form 8-K/A (20/05/2026): https://www.otcmarkets.com/filing/html?guid=eLF-kenypr1Jr3h&id=19466372
- West, "Company Impact Updates": https://www.westpharma.com/support/cyberattack-updates
Does your company have a ransomware response plan? KGA IT can help you build one, with a free consultation: kga-it.com.