West Pharmaceutical Services has disclosed a cyberattack that resulted in stolen data, encrypted systems, and operational disruptions across parts of the company’s global network.
The Pennsylvania-based pharmaceutical manufacturer said it first detected suspicious activity on May 4, 2026, and later determined the incident was a “material cybersecurity attack.” According to a filing submitted to the US Securities and Exchange Commission (SEC), attackers exfiltrated data from company systems before deploying file-encrypting malware.
In response, West Pharmaceutical shut down and isolated the affected on-premise infrastructure globally to contain the attack. The company also restricted access to enterprise systems, activated crisis management procedures, and notified law enforcement.
The cyberattack temporarily disrupted business operations worldwide, including systems used for shipping, receiving, and manufacturing processes. West Pharmaceutical said some critical operations have since resumed, but restoration efforts are still ongoing at multiple sites, and the timeline for full recovery remains unclear.
The company has not disclosed what type of data was stolen or whether customer, employee, or partner information was affected. It has also not revealed how many systems were encrypted during the attack.
West Pharmaceutical said it hired external cybersecurity and forensic experts to investigate the breach and assist with recovery efforts. Palo Alto Networks’ Unit 42 incident response team was brought in to help contain the intrusion and restore systems.
While the company did not officially describe the incident as ransomware, multiple reports noted that the attack followed a double-extortion pattern commonly used by ransomware groups, where attackers steal sensitive data before encrypting systems to increase pressure on victims.
No ransomware gang has publicly claimed responsibility for the attack so far. However, West Pharmaceutical stated it has taken steps to reduce the risk of the stolen data being distributed publicly, language that researchers say may suggest negotiations with the attackers took place.
West Pharmaceutical manufactures injectable drug packaging, containment systems, and delivery components used by pharmaceutical and biotechnology companies worldwide. The company operates across roughly 50 sites globally and supplies billions of components annually to the healthcare industry.
At this stage, the company says it has not yet determined the financial impact of the incident or whether the attack will materially affect future operations or business results.