West Pharmaceutical cyberattack disrupts global operations

Analyst assessment

DysruptionHub’s published report documented that West Pharmaceutical Services experienced a May 4, 2026 cyberattack that disrupted global operations. West’s Form 8-K said an unauthorized party exfiltrated certain data and encrypted certain systems, prompting the company to take systems offline globally for containment.

DysruptionHub assesses with high confidence that the incident was a ransomware-style intrusion involving both encryption and data theft. West did not publicly confirm a ransom demand, payment, ransomware family or threat actor, so the public record supports high-confidence ransomware rather than confirmed extortion attribution.

Operational significance

The incident disrupted West’s global manufacturing and supply-chain operations. The company said core enterprise systems were restored first, while shipping, receiving and manufacturing restarted in phases across multiple sites. West supplies components and delivery systems used by pharmaceutical and biotechnology manufacturers, so prolonged disruption carried downstream supply-continuity risk even though no patient-facing service interruption was publicly documented.

West used business-continuity measures and coordinated with customers while restoring operations. A May 15 update said shipping, receiving and manufacturing were operational or ramping across the company’s major site groups. West’s May 20 Form 8-K/A then said critical manufacturing, receiving and shipping processes had restarted at all sites and that manufacturing, supply-chain and commercial sites were fully operational globally.

West’s official locations directory identifies U.S. facilities in Scottsdale and Tempe, Arizona; Clearwater and St. Petersburg, Florida; Greenfield, Indiana; Walker, Michigan, which West labels Grand Rapids; Kearney, Nebraska; Kinston, North Carolina; Exton, Jersey Shore, Radnor, Upper Darby and Williamsport, Pennsylvania; and Cidra, Puerto Rico. Because West described the incident and recovery as global and across all sites, DysruptionHub assesses with medium confidence that these facilities were within the incident’s operational scope. West did not publish site-specific outage durations or severity.

Disclosure posture

West publicly disclosed the incident through customer updates and SEC filings. Its statements identified the intrusion date, global containment actions, data exfiltration, system encryption, phased operational recovery, law-enforcement notification and engagement of external forensic specialists.

The company did not identify the categories or volume of exfiltrated data, whether customers or employees were affected, whether a ransom demand was received, or whether any payment or negotiation occurred. West said it took steps intended to reduce the risk that the exfiltrated data would be disseminated, but that statement does not establish extortion or payment.

West’s second-quarter results referenced nonrecurring professional fees associated with the May cyber incident but did not isolate an incident-specific amount. The company raised full-year sales and earnings guidance, consistent with its earlier assessment that the event was not reasonably likely to materially affect 2026 guidance.

Confidence and uncertainty

Confidence is high that unauthorized access, data exfiltration, encryption and global operational disruption occurred because West stated each fact in its SEC filing and public updates. Confidence is high that operations were restored because the company declared all manufacturing, supply-chain and commercial sites fully operational on May 20.

Ransomware confidence is high, based on the combination of data theft and system encryption, but the organization did not publicly use that term in the reviewed primary sources. Extortion indicators remain unresolved because no ransom note, demand, leak-site listing, deadline, payment instruction or threat actor was publicly identified.

Retrospective note

West reported full operational restoration on May 20. Its May 27 update said Unit 42 had found no continuing related unauthorized activity as of May 5 and that production was still ramping to support customers. DysruptionHub therefore assesses the incident as resolved while using May 27 as the latest dated observation of operational recovery work.

Analytic gaps

The reviewed sources do not establish the initial access vector, compromised account or device, vulnerability exploited, ransomware family, dwell time, encryption scope by site, backup impact, ransom demand, payment status or threat actor. They also do not identify the categories, volume, ownership or notification implications of the exfiltrated data, or quantify the impact at individual facilities.