West Pharmaceutical Services (drug packaging and delivery components): data theft and encryption force global shutdown

What happened

• West detected an intrusion on 4 May 2026 and on 7 May determined it had a “material cybersecurity attack”: data was exfiltrated and certain systems encrypted. Systems were taken offline globally, temporarily disrupting operations worldwide; by 11 May core enterprise systems were restored and shipping, receiving and manufacturing had restarted at some sites.
• Root cause / initial access: not disclosed.
• Attacker: not named in the 8-K.
• Response: law enforcement notified, forensic experts engaged, steps taken to limit dissemination of stolen data.

Sources

• https://www.sec.gov/Archives/edgar/data/105770/000010577026000068/wst-20260507.htm
• https://www.cm-alliance.com/cybersecurity-blog/major-cyber-attacks-data-breaches-ransomware-attacks-of-may-2026

This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.