West Pharmaceutical Services, Inc.
West Pharmaceutical cyberattack disrupts global operations
Summary
West Pharmaceutical Services detected a cyberattack on May 4, 2026, in which an unauthorized party exfiltrated data and encrypted systems. The company took systems offline globally, disrupting manufacturing, shipping, receiving, and enterprise operations before reporting full operational restoration on May 20.
Key facts
Timeline
-
Incident start:
?
Earliest known or assessed start of malicious activity or incident activity. -
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing. -
Incident end:
?
Confirmed or defensibly assessed end of material operational disruption or incident activity.
Primary victim organization
Impacted locations
Organization types
Critical infrastructure sector
DysruptionHub coverage
Incident characteristics
Assessments
DD-CIT assessment
The organization publicly identifies the event as cyber-related. The organization publicly documents the resulting service disruption.
Attack mechanisms
-
Ransomware
Malware that encrypts systems or data, typically accompanied by a ransom demand.
-
Unauthorized access
Unauthorized access to systems, accounts, networks, or data.
Data impacts
-
Data theft or exfiltration
Data was copied, transferred, downloaded, or otherwise removed from the affected environment by an unauthorized party.
-
Data encryption
Data was rendered inaccessible through unauthorized encryption, including ransomware-related encryption.
Operational impacts
-
Network outage
Internal or external network connectivity was unavailable or materially impaired.
-
Internal systems unavailable
Internal business, administrative, operational, or staff-facing systems were unavailable.
-
Manufacturing or production disruption
Manufacturing, production, assembly, processing, or industrial operations were reduced, stopped, or impaired.
-
Supply chain disruption
Procurement, inventory, warehousing, shipping, delivery, vendor, or other supply-chain processes were materially affected.
-
Service delay
Services continued but with longer processing, response, delivery, or completion times.
-
Staff unable to work normally
Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.
Extortion indicators
-
Unknown extortion indicators
The incident may involve extortion, but available evidence does not establish which extortion indicators were present.
Incident narrative
Analyst assessment
DysruptionHub’s published report documented that West Pharmaceutical Services experienced a May 4, 2026 cyberattack that disrupted global operations. West’s Form 8-K said an unauthorized party exfiltrated certain data and encrypted certain systems, prompting the company to take systems offline globally for containment.
DysruptionHub assesses with high confidence that the incident was a ransomware-style intrusion involving both encryption and data theft. West did not publicly confirm a ransom demand, payment, ransomware family or threat actor, so the public record supports high-confidence ransomware rather than confirmed extortion attribution.
Operational significance
The incident disrupted West’s global manufacturing and supply-chain operations. The company said core enterprise systems were restored first, while shipping, receiving and manufacturing restarted in phases across multiple sites. West supplies components and delivery systems used by pharmaceutical and biotechnology manufacturers, so prolonged disruption carried downstream supply-continuity risk even though no patient-facing service interruption was publicly documented.
West used business-continuity measures and coordinated with customers while restoring operations. A May 15 update said shipping, receiving and manufacturing were operational or ramping across the company’s major site groups. West’s May 20 Form 8-K/A then said critical manufacturing, receiving and shipping processes had restarted at all sites and that manufacturing, supply-chain and commercial sites were fully operational globally.
West’s official locations directory identifies U.S. facilities in Scottsdale and Tempe, Arizona; Clearwater and St. Petersburg, Florida; Greenfield, Indiana; Walker, Michigan, which West labels Grand Rapids; Kearney, Nebraska; Kinston, North Carolina; Exton, Jersey Shore, Radnor, Upper Darby and Williamsport, Pennsylvania; and Cidra, Puerto Rico. Because West described the incident and recovery as global and across all sites, DysruptionHub assesses with medium confidence that these facilities were within the incident’s operational scope. West did not publish site-specific outage durations or severity.
Disclosure posture
West publicly disclosed the incident through customer updates and SEC filings. Its statements identified the intrusion date, global containment actions, data exfiltration, system encryption, phased operational recovery, law-enforcement notification and engagement of external forensic specialists.
The company did not identify the categories or volume of exfiltrated data, whether customers or employees were affected, whether a ransom demand was received, or whether any payment or negotiation occurred. West said it took steps intended to reduce the risk that the exfiltrated data would be disseminated, but that statement does not establish extortion or payment.
West’s second-quarter results referenced nonrecurring professional fees associated with the May cyber incident but did not isolate an incident-specific amount. The company raised full-year sales and earnings guidance, consistent with its earlier assessment that the event was not reasonably likely to materially affect 2026 guidance.
Confidence and uncertainty
Confidence is high that unauthorized access, data exfiltration, encryption and global operational disruption occurred because West stated each fact in its SEC filing and public updates. Confidence is high that operations were restored because the company declared all manufacturing, supply-chain and commercial sites fully operational on May 20.
Ransomware confidence is high, based on the combination of data theft and system encryption, but the organization did not publicly use that term in the reviewed primary sources. Extortion indicators remain unresolved because no ransom note, demand, leak-site listing, deadline, payment instruction or threat actor was publicly identified.
Retrospective note
West reported full operational restoration on May 20. Its May 27 update said Unit 42 had found no continuing related unauthorized activity as of May 5 and that production was still ramping to support customers. DysruptionHub therefore assesses the incident as resolved while using May 27 as the latest dated observation of operational recovery work.
Analytic gaps
The reviewed sources do not establish the initial access vector, compromised account or device, vulnerability exploited, ransomware family, dwell time, encryption scope by site, backup impact, ransom demand, payment status or threat actor. They also do not identify the categories, volume, ownership or notification implications of the exfiltrated data, or quantify the impact at individual facilities.
Organizations involved
Impacted locations
Scottsdale, Arizona
West lists two Scottsdale facilities; company updates described systems offline globally and restoration across all sites.
Tempe, Arizona
West lists two Tempe manufacturing facilities; company updates described systems offline globally and restoration across all sites.
Clearwater, Florida
West lists a Clearwater receiving, warehouse and distribution facility; company updates described global supply-chain restoration.
St. Petersburg, Florida
West lists a St. Petersburg manufacturing facility; company updates described systems offline globally and restoration across all sites.
Greenfield, Indiana
West lists a Greenfield assembly and packaging facility; company updates described systems offline globally and restoration across all sites.
Walker, Michigan
West labels the Walker facility as Grand Rapids; company updates described systems offline globally and restoration across all sites.
Kearney, Nebraska
West lists a Kearney manufacturing facility; company updates described systems offline globally and restoration across all sites.
Kinston, North Carolina
West lists a Kinston manufacturing facility; company updates described systems offline globally and restoration across all sites.
Exton, Pennsylvania
Jersey Shore, Pennsylvania
West lists a Jersey Shore manufacturing facility; company updates described systems offline globally and restoration across all sites.
Radnor, Pennsylvania
West lists a Radnor research facility; global enterprise systems were restricted and restored during the incident.
Upper Darby, Pennsylvania
West lists an Upper Darby tooling facility supporting manufacturing; company updates described systems offline globally and restoration across all sites.
Williamsport, Pennsylvania
West lists a Williamsport manufacturing facility; company updates described systems offline globally and restoration across all sites.
Cidra, Puerto Rico
West lists a Cidra contract-manufacturing facility; company updates described systems offline globally and restoration across all sites.
Sources
Greenfield’s planning profile describes its architectural heritage, historic downtown, employment base and association with poet James Whitcomb Riley, who was born in the city in 1849.
The Census Bureau estimated St. Petersburg’s population at 264,033 on July 1, 2025, 2.2 percent above the April 2020 estimates base.
The territorial fact sheet describes Puerto Rico’s Caribbean location, mountainous terrain, coastal plains, tropical climate and manufacturing-led economy.
The Indiana Historical Bureau states that Indiana was admitted to the Union on Dec. 11, 1816, becoming the second state formed from the Northwest Territory.
The Census Bureau estimated Tempe’s population at 190,571 on July 1, 2025.
Clearwater describes its Gulf Coast and Tampa Bay location, beach setting and strengths in technology, marine, life-science, manufacturing and financial industries.
Nebraska became a state on March 1, 1867, after the territory was organized in 1854.
The Census Bureau estimated Puerto Rico’s population at 3,184,835 on July 1, 2025, 3.1 percent below the April 2020 estimates base.
The plan describes Exton as the township’s crossroads and commercial core, with rail access, mixed-use development and the Chester Valley Trail.
The Census Bureau estimated Radnor’s population at 32,930 in 2025.
The Census Bureau estimated Clearwater’s population at 114,364 on July 1, 2025, 2.5 percent below the April 2020 estimates base.
The Census Bureau estimated Hancock County’s population at 90,969 on July 1, 2025.
The county plan says Hancock County was created in 1828, named for John Hancock and developed east of Indianapolis around farmland, the Blue River and later regional transportation routes including Interstate 70.
The city record identifies specialized manufacturing, marine and life sciences, financial services, data analytics, and creative arts and design as locally targeted industries.
The 2020 census counted 5,622 residents in the Exton census-designated place.
The Census Bureau estimated Cidra municipio’s population at 39,669 on July 1, 2025, 0.8 percent below the April 2020 estimates base.
The Census Bureau estimated Kinston’s population at 19,705 on July 1, 2025, 0.5 percent below the April 2020 estimates base.
The county describes its 1855 boundaries, 1864 organization, bison-derived name, Platte Valley settlement, transportation history and agricultural and industrial character.
The Census Bureau estimated Pinellas County’s population at 948,563 on July 1, 2025, 1.1 percent below the April 2020 estimates base.
The county profile describes Chester County’s southeastern Pennsylvania setting, 1682 founding, waterways, agriculture, trails and modern industries.
The territorial directory places Cidra in Puerto Rico’s central-eastern region, lists its neighboring municipalities and describes its elevations, hills and lake area.
Lenoir County describes its eastern North Carolina location roughly midway between Raleigh and Morehead City, identifies Kinston as the county seat and La Grange and Pink Hill as its other incorporated municipalities, and characterizes the county as a blend of agriculture and manufacturing.
The Census Bureau estimated Scottsdale’s population at 243,006 on July 1, 2025.
The Census Bureau estimated Williamsport’s population at 27,384 in 2025.
The borough profile places Jersey Shore on the West Branch Susquehanna River and explains its Waynesburg name, New Jersey settlers and 1826 incorporation.
Indiana’s official tourism profile describes terrain ranging from Lake Michigan beaches to central farmland and southern rolling hills, with manufacturing and agriculture among the state’s major industries.
The Census Bureau estimated Nebraska’s population at 2,018,006 on July 1, 2025.
The township describes its 1786 establishment, dense and diverse neighborhoods, business districts and transportation connections.
The department describes a long-running pharmaceutical packaging and drug-delivery manufacturing presence in Cidra and its role in the mountain region’s employment and exports.
Scottsdale describes Winfield Scott’s 1888 agricultural settlement, the growth of arts and resorts, Taliesin West and preservation of the Sonoran Desert.
The city traces Kearney Junction to the 1871 railroad settlement, recounts its boom-and-bust years and the 1904 opening of the college that became the University of Nebraska at Kearney.
The Census Bureau estimated Buffalo County’s population at 51,156 on July 1, 2024.
The township history describes Lenape homelands, Welsh Quaker settlement, the 1832 railroad and Main Line suburban development.
The Census Bureau estimated Kearney’s population at 34,782 on July 1, 2025.
The plan describes the Platte, Wood and South Loup river valleys, northern uplands, tablelands and a sandhills area near Ravenna.
The Census Bureau estimated Greenfield’s population at 26,544 on July 1, 2025.
The Census Bureau estimated Lenoir County’s population at 55,837 on July 1, 2025, an increase of 1.3 percent from the April 2020 estimates base.
The Census Bureau estimated Lycoming County’s population at 112,587 on July 1, 2025.
The state-owned Global TransPark describes its 2,500-acre Kinston site and its role in aviation, aerospace, defense, logistics, emergency response and advanced-materials industries.
The county profile describes Pinellas as a 280-square-mile peninsula between the Gulf and Tampa Bay, lists 24 municipalities and identifies major regional industries.
The county survey describes Lycoming County’s formation in 1795, frontier settlement, lumber era and resource-based development.
The Census Bureau estimated Upper Darby’s population at 85,458 in 2025.
The Census Bureau estimated Indiana’s population at 6,973,333 on July 1, 2025.
The Census Bureau estimated Chester County’s population at 557,116 on July 1, 2025.
The Puerto Rico Tourism Company states that the island is composed of 78 municipalities organized into six tourism regions.
The state profile identifies the Neuse River as a predominant feature, describes Lenoir County as largely rural and agricultural, and notes the Kinston Regional Jetport and Global TransPark’s role in aviation employment.
Tempe traces the area’s canal-building history, Hayden’s Ferry, the 1879 naming of the town and the 1885 founding of the Territorial Normal School that became Arizona State University.
West Pharmaceutical Services said a May 4 cyberattack disrupted global operations. The company confirmed that data was exfiltrated, systems were encrypted, and shipping, receiving, and manufacturing processes were being restored in stages.
West said it determined on May 7 that it had experienced a material cybersecurity attack in which certain data was exfiltrated and certain systems were encrypted. The company took systems offline globally, disrupting business operations while manufacturing, shipping, and receiving were restored in phases.
West reported on May 20 that manufacturing, supply-chain, and commercial sites were fully operational globally. Earlier updates described phased restoration of enterprise systems, shipping, receiving, and manufacturing across multiple sites.
Cybersecurity Dive reported that West was restoring global operations after attackers stole data and encrypted systems, affecting critical manufacturing, shipping, and receiving processes.
West said critical manufacturing, receiving and shipping processes had restarted at all sites and that manufacturing, supply-chain and commercial sites were fully operational globally. It said no continuing unauthorized activity had been observed since May 5 and did not expect a material effect on 2026 guidance.
West’s directory identifies U.S. headquarters, manufacturing, development, distribution, tooling and laboratory facilities in Arizona, Florida, Indiana, Michigan, Nebraska, North Carolina, Pennsylvania and Puerto Rico, with site addresses and operating functions.
West’s second-quarter results referenced nonrecurring professional fees associated with the May cybersecurity incident but did not isolate the incident-specific amount. The company raised its full-year net-sales and earnings guidance.
See something that needs correction?
Signed-in members can report an error, update, or missing source.