In May 2026 an intrusion at West, maker of stoppers and seals for injectable medicines, encrypted unspecified systems and West took its systems offline worldwide. All sites restarted by 20 May. The one clean number is a delay.
West’s filing names both causes of the disruption in one sentence: the incident and the company’s proactive response. An intruder exfiltrated data and encrypted unspecified systems, and West took its systems offline globally. Nothing on the record says a control system was reached, but because the encrypted systems are unspecified, an OT component is neither shown nor ruled out.
West did the right thing, fast: every site was running by 20 May. The only clean figure is about $7M of West Vantage revenue pushed into the second half, which West expects to make up: a delay, not a loss. BlastWave’s reading, not a disclosed fact: isolating everything, the correct security decision, was also a production decision, because the systems that tell a plant what to make sat on the side of the switch that had to be thrown. The lesson: arrange a plant so the next precautionary disconnection costs a head office, not a factory.
What is not known: West has never said which systems were encrypted, whether any sat in a plant, or how much downtime came from the encryption rather than from its own decision to take systems offline worldwide. How many sites stopped, and for how long, is undisclosed, as are the way in and what data left. No group is on the record claiming the attack and no government has attributed it. No incident cost has been disclosed: the $6.9M line blends legal matters with the incident. Whether any customer’s filling line waited is not on the record.
Recommendation
Take IT out of the production path Put scheduling, manufacturing execution, batch records, labelling and serialisation on the plant’s side, so isolating IT in an incident does not also stop the lines.
Remove standing access to production Nothing reaches into the production zone on a standing account or a shared remote-access path. Access is by identity, time-boxed and logged.
Make plant data flow one way Planning, ERP and reporting read from production over a one-way path, so they can be cut off in an incident without the plant noticing.
Sources: Form 8-K, 11 May 2026 (Item 1.05); Form 8-K/A, 20 May 2026 (Item 1.05); Q2 2026 results, 8-K Ex. 99.1, 23 Jul 2026; Form 10-Q, quarter ended 30 Jun 2026; West “Company Impact Updates,” 7 to 27 May 2026.. Full list with links.
Soft Spots: “No OT compromise on the record” means exactly that; which systems were encrypted is undisclosed. The switch-side argument is BlastWave’s analysis. The ~$7M 10-Q wording was not read verbatim; its catch-up is West’s forecast.
The full record
Every claim numbered to its source. Last updated .
An intruder took data and encrypted systems West has never named; West switched its own systems off worldwide to contain it and had every site running again by 20 May 2026. What is verified, what is only reported, and what is still unknown.
Summary
In May 2026 an intruder exfiltrated data from West Pharmaceutical Services, a maker of stoppers, seals and other components for injectable medicines, and encrypted systems West has never named. West took its own systems offline worldwide, and all sites restarted by 20 May. Nothing on the record says plant control systems were reached, and no incident cost has been disclosed.1,3,8
Timeline of the West Pharmaceutical cyberattack
Every date is tied to a source. Press reporting appears only as evidence of what was said.
West detects an intrusion and activates incident response, including proactively taking systems offline globally for containment, notifying law enforcement and engaging external cyber-forensic experts.1
The last date on which West says unauthorized activity or access was observed.3
West determines it has experienced a material cybersecurity attack in which data was exfiltrated and certain systems were encrypted. Its dated incident update page begins the same day.1,9
West files a Form 8-K under Item 1.05. Shipping, receiving and manufacturing have restarted at some sites.1
The Record publishes a West statement that it is using its business continuity plans and working with customers to minimize delays. SecurityWeek reports no known group claiming responsibility as of that date.4,10
BleepingComputer reports that no group has taken credit at the time of writing. West's update page reports restoration continuing through 15 May.5,9
West files an amended 8-K: manufacturing, receiving and shipping have restarted at all sites, the company is "fully operational," and no unauthorized activity has been observed since 5 May. West says the incident is not reasonably likely to have a material impact on its 2026 second-quarter or full-year guidance.3
Second-quarter results: a $6.9M line of nonrecurring professional fees that blends legal matters with the incident, and higher full-year guidance. The 10-Q records about $7M of West Vantage revenue affected by the incident. On the earnings call, per a published transcript, the chief financial officer says the segment could not fully recover in the quarter, pushing some revenue into the second half.2,7,8
At the Morgan Stanley Global Healthcare Conference, per a published transcript, management says it adjusted its production plan so customers had no stock outs, and expects about $7M of revenue to catch up in the third and fourth quarters.11
Key facts and their status
Verified sworn, filed or published by the primary party. Reported rests on press, researchers or unnamed sources. Undisclosed no one has stated it.
Question
What the record says
Status
Were systems encrypted?
Yes, "certain systems." Which ones has never been stated1,3
Verified
Was data taken?
Yes, "certain data was exfiltrated by an unauthorized party." What data: not stated1
Verified
Who took West's systems offline?
West itself, "proactively" and globally, for containment1
Verified
Were plant control systems (OT) reached?
Not on the record. The encrypted systems are unspecified, so an OT component is neither shown nor ruled out1,3
Undisclosed
Was it ransomware?
West's filings since the incident never use the word. Encryption and exfiltration are West's words; "ransomware" is the press's1,4,5,6
Reported only
Who was behind it?
No group on the record claiming it in reporting read through mid-May 2026; no government attribution4,5
No unauthorized activity observed after 5 May 2026, by West's account3
Verified (West's account)
When were all sites running again?
By 20 May 2026, sixteen days after detection. The exact date of the last restart is not given3
Verified
What did the incident cost?
Not disclosed. The $6.9M fee line blends legal matters with the incident8
Undisclosed
What is the about $7M figure?
West Vantage revenue pushed into the second half, which West expects to make up: a timing shift, not a cost2,7,11
Verified (catch-up is a forecast)
Did it cause a drug shortage?
Nothing on the record says so; no FDA statement found, as of late September 2026, ties a shortage to the incident11
Not on the record
What happened at West Pharmaceutical in May 2026?
An intruder exfiltrated data and encrypted unspecified systems, and West took its own systems offline worldwide to contain it. West detected the intrusion on 4 May 2026 and activated its incident response that day, including proactively taking systems offline globally, notifying law enforcement and engaging external cyber-forensic experts.1 On 7 May it reached the determination it filed under Item 1.05 of Form 8-K on 11 May:
"...the Company has experienced a material cybersecurity attack, in which certain data was exfiltrated by an unauthorized party and certain systems were encrypted."
West makes the containment and delivery components that sit around injectable medicines, such as stoppers, seals, and syringe and cartridge components, and runs contract manufacturing under the West Vantage segment.2 Its restart came in phases: shipping, receiving and manufacturing had restarted at some sites by 11 May,1 West's own update page tracked restoration through mid-May and records the engagement of Palo Alto Networks Unit 42,9 and on 20 May an amended filing reported restart at all sites and the company "fully operational."3
West also said it had taken steps "intended to mitigate the risk of dissemination of the exfiltrated data."1 It has never said what those steps were. Nothing on the record supports inferring a payment, a negotiation or the absence of either.
Did the attack or West's own shutdown stop production?
Both, by West's own account, and West has never separated them. The 11 May filing names two causes of the disruption in a single sentence:
"The incident and the Company's proactive response have temporarily disrupted the Company's business operations globally."
Most incident disclosures name only the attacker. This one names the cure as well. How much of the roughly two weeks of disruption came from the encryption and how much from West's decision to disconnect everything is not stated in any record we could read.1,3 The timing is clear on West's account: no unauthorized activity was observed after 5 May, so the intruder was contained in about a day, while every site was running again only by 20 May.1,3
Were West's plants or control systems hacked?
Nothing on the record says a control system or production equipment was reached, and nothing rules it out. West's filings say "certain systems were encrypted" and never say which.1,3 That places the incident, provisionally, as an IT compromise halting physical operations.
Commentary that the phased restart shows an IT breach reached the production line is a reading, not a finding. A phased restart is what you would see if plant systems had been encrypted. It is also what you would see if a company disconnected everything on purpose and brought it back carefully, which West's own filing says it did.1 The record supports the second and is silent on the first.
Was it ransomware, and who was behind it?
West has never called it ransomware, and no one is on the record claiming it. A full-text search of West's SEC filings returns no use of "ransomware" in anything filed since the incident; the only 2026 hits are the annual report and proxy statement filed before 4 May.6 West's words are "exfiltrated" and "encrypted."1 That is the ransomware pattern and the inference is reasonable, but it is the press's word, not West's.
SecurityWeek on 12 May and BleepingComputer on 13 May 2026 reported that no group had claimed the attack as of those dates,4,5 and no government has attributed it. If a leak-site listing appears later, the accurate wording is "claimed by," not "attributed to."
If West beat its quarter, was the attack really material?
Yes: it was material to the operation, not to the results. West called the attack material on 7 May, before anyone knew the financial outcome, and two weeks of global disruption is material to how a company runs.1 On 20 May it said the incident was not reasonably likely to have a material impact on its 2026 second-quarter or full-year guidance,3 and in July the quarter came in above expectations and full-year guidance went up.7,8 Both statements are true. The second does not make the first an overreaction.
No incident cost has been disclosed. The two dollar figures attached to the incident are a blend and a delay, and neither is a cost. The second-quarter earnings release carries a $6.9M line that West describes as "nonrecurring professional fees associated with various items including certain legal matters and our cybersecurity incident from May 2026."8 Nothing public separates the incident's share.
The other figure is about $7M of West Vantage revenue that slipped out of the second quarter. A full-text search confirms the 10-Q pairs "approximately $7 million" with the cybersecurity incident and West Vantage;2,6 on the earnings call, per a published transcript, the chief financial officer explained it this way:
"not able to fully recover in the quarter, pushing some revenues into the second half of the year"
Management said in September that it expects about $7M of revenue to catch up in the second half.11 That makes it a delay rather than a loss on West's account. It is a forecast, not yet a reported result.
Did the attack cause a shortage of injectable medicines?
Nothing on the record says so. During the outage West said it was working with its customers "to mitigate risk and minimize delays wherever possible."10 In September, per a published transcript, management said it adjusted its production plan so customers had no stock outs.11 No FDA statement found, as of late September 2026, ties any shortage to the incident.
West sits one step upstream of filling lines for injectable medicines. That customers' safety stock absorbed the two weeks is BlastWave's analysis, not a disclosed fact. A figure circulating in commentary about West's share of the world's injectable drugs is a commentator's assessment and is not used here.
What is still not known about West Pharmaceutical
Which systems were encrypted, and whether any of them sat in a plant.1,3
How much of the downtime came from the encryption rather than from West's own decision to take systems offline worldwide.1
How many sites stopped, and for how long each.
How the intruder got in, and what the root cause was.
What data was exfiltrated, and what the steps "intended to mitigate the risk of dissemination" were.1
Who was behind it. No group is on the record claiming it and no government has attributed it.
The incident's cost, including its share of the blended $6.9M fee line.8
Whether the about $7M of West Vantage revenue was in fact made up. As of late September 2026, third-quarter results had not been filed.
Whether any customer's filling line waited for components.
Claims about West Pharmaceutical the record does not support
Widely repeated claim
What the record says
"West Pharmaceutical was hit by ransomware."
West's filings since the incident never use the word. West said data was exfiltrated and systems encrypted; "ransomware" is the press's inference, and no group is on the record claiming it.1,4,5,6
"The phased restart reveals that the breach reached West's production line."
A reading, not a finding. West never said which systems were encrypted, and its own filing names its proactive global shutdown as a cause of the disruption. An OT component is neither shown nor ruled out.1,3
BlastWave analysis: the right call was the expensive one
Analysis, not a disclosed fact
West did the right thing and did it fast: by its own account the intruder was contained in about a day, and every site was running by 20 May.3 The argument here is not competence, and it is BlastWave's analysis, not a disclosed fact: the correct security decision, isolate everything, was also a production decision, because the systems that tell a plant what to make, when and under which label sat on the side of the switch that had to be thrown. The filings never say which systems gated production.
The lesson is to arrange a plant so the next precautionary disconnection costs a head office, not a factory. Nothing here says West's segmentation was poor; the record does not describe it at all.
Podcast: “The Sorting Centre” (9:21). Joe Baxter and Cam Cullen on why the right security call was also the expensive production call.
Video: West Pharmaceutical Short (60 to 90 seconds).
Frequently asked questions
What happened in the West Pharmaceutical cyberattack?
West Pharmaceutical Services detected an intrusion on 4 May 2026 and took its systems offline globally to contain it. On 7 May it determined it had suffered a material cybersecurity attack in which data was exfiltrated and certain systems were encrypted, and it disclosed this in a Form 8-K on 11 May. Some sites restarted by 11 May, and West reported all sites restarted and the company fully operational on 20 May 2026.
Was the West Pharmaceutical attack ransomware?
West has never used the word. Its SEC filings say data was exfiltrated and certain systems were encrypted, and a full-text search of its filings since the incident finds no use of "ransomware." Press coverage called it ransomware, which is a reasonable inference from encryption plus data theft, but it is not West's word. No group was on the record claiming the attack in reporting read through mid-May 2026.
Were West Pharmaceutical's factories or control systems hacked?
Nothing on the record says so, and nothing rules it out. West's filings say only that "certain systems" were encrypted and never say which. West's 11 May 2026 filing says the incident and the company's own proactive response together disrupted operations globally, so a phased restart does not by itself show that plant systems were hit. Any OT component is neither shown nor ruled out.
How long was West Pharmaceutical down?
West detected the intrusion on 4 May 2026 and took systems offline that day. By West's account no unauthorized activity was observed after 5 May. Shipping, receiving and manufacturing restarted at some sites by 11 May, and West's amended 8-K of 20 May 2026 reported restart at all sites, about sixteen days after detection. The exact date of the last site's restart is not given.
How much did the cyberattack cost West Pharmaceutical?
No incident cost has been disclosed. West's second-quarter 2026 earnings release shows $6.9 million of nonrecurring professional fees covering various items including certain legal matters and the May 2026 incident, so it is a blend, not the cost of the attack. Separately, about $7 million of West Vantage revenue slipped into the second half of 2026, which management expects to make up: on West's account a delay, not a loss.
Who was behind the West Pharmaceutical attack?
Nobody is on the record. West has not named an attacker, no government has attributed the attack, and SecurityWeek on 12 May and BleepingComputer on 13 May 2026 reported that no group had claimed responsibility as of those dates. How the intruder got in has also never been disclosed. If a group claims it later, that is a claim, not an attribution.
Did the West Pharmaceutical attack cause a shortage of injectable drugs?
Nothing on the record says so. During the outage West said it was working with customers to mitigate risk and minimize delays. At a September 2026 investor conference, according to a published transcript, management said it adjusted its production plan so customers had no stock outs. BlastWave found no FDA statement, as of late September 2026, tying any shortage to the incident.
Primary sources are West Pharmaceutical Services' own SEC filings and its dated incident update page. Published transcripts are cited for management's remarks, and press only as evidence of what was said.
Company filingWest Pharmaceutical Services, Inc., Form 8-K, Item 1.05, filed 11 May 2026 (accession 0000105770-26-000068). sec.gov
Company filingWest Pharmaceutical Services, Inc., Form 10-Q for the quarter ended 30 June 2026, filed 23 July 2026 (accession 0000105770-26-000099). sec.gov
Company filingWest Pharmaceutical Services, Inc., Form 8-K/A (Amendment No. 1), Item 1.05, filed 20 May 2026 (accession 0000105770-26-000077). sec.gov
PressSecurityWeek, report on the West Pharmaceutical Services attack, 12 May 2026. Cited as evidence of what was said, including that no group had claimed it as of that date.
PressBleepingComputer, "West Pharmaceutical says hackers stole data, encrypted systems," 13 May 2026. Cited as evidence of what was said, including that no group had claimed it at the time of writing. bleepingcomputer.com
FederalUS Securities and Exchange Commission, EDGAR full-text search, filings of West Pharmaceutical Services, Inc. (CIK 0000105770): "cybersecurity incident" returns the 8-K, 8-K/A, earnings release and 10-Q; "ransomware" returns no filing since 1 May 2026. Run 24 September 2026 and re-checked 28 September 2026.
PressInvesting.com, "Earnings call transcript: West Pharmaceutical beats Q2 2026 estimates, lifts outlook," transcript of West's second-quarter 2026 earnings call, 23 July 2026. Third-party transcript, cited for management's remarks.
Company filingWest Pharmaceutical Services, Inc., "West Reports Second-Quarter 2026 Results," Exhibit 99.1 to Form 8-K, filed 23 July 2026 (accession 0000105770-26-000097), non-GAAP reconciliation footnote on "Other." sec.gov
CompanyWest Pharmaceutical Services, "Company Impact Updates," dated entries 7, 11, 13, 15, 20 and 27 May 2026. westpharma.com
PressThe Record from Recorded Future News, report on West Pharmaceutical's statement on business continuity and customers, 12 May 2026. Cited as evidence of what was said.
PressInvesting.com, "West Pharmaceutical Services at Morgan Stanley Conference," summary transcript of West's session at the Morgan Stanley Global Healthcare Conference, 14 September 2026. Third-party transcript, cited for management's remarks.
Cite this page
BlastWave. “West Pharmaceutical Cyberattack (2026): What Is Verified.” Hackopedia, Volume 2, FILE 039. Last verified 28 September 2026. https://hackopedia.blastwave.com/manufacturing/west-pharmaceutical-2026/
Revision history
Date
Change
6 Oct 2026
Numbered FILE 039 in Hackopedia Volume 2, in the Manufacturing edition.
28 Sep 2026
Hand-check at source: a full-text search of West's SEC filings re-run, confirming that "ransomware" appears in nothing filed since the incident. Confirmed that the argument about which systems gated production is labelled as BlastWave's analysis throughout, since no filing says which systems those were.
26 Sep 2026
Full validation: the 8-K, the amended 8-K and the second-quarter earnings release re-read, and every quoted sentence matched. Corrected "restarted within two weeks" to "all sites restarted by 20 May" (the record bounds the date but does not give it), and qualified every "delayed, not lost" as West's expectation, because the catch-up is a forecast, not a reported result.
24 Sep 2026
Volume 2 entry built from primary sources: West's SEC filings, its dated incident update page and a full-text search of its filings.
How Hackopedia verifies an entry
Every figure, date and quotation traces to a court record, sworn testimony, a government or regulator document, the operator's own dated statements, a named researcher's published work, or a dated publication named as such. Where the record says less than the headlines, we print what the record says and mark the rest as reported or undisclosed. Pages are re-verified when new filings, rulings or official statements appear, and every change is logged. Why Hackopedia exists · How to read an entry
