West Pharmaceutical Services
US pharmaceutical-packaging manufacturer whose May 2026 ransomware incident forced a global shutdown and SEC disclosure.
West Pharmaceutical Services filed an SEC Form 8-K on 7 May 2026 disclosing a material cybersecurity incident, detected 4 May, that took shipping, manufacturing and shared services offline globally.
Last refreshed: 3 August 2026 · Appears in 1 active topic
If a pharma supply-chain manufacturer goes dark globally, how long before drug-delivery timelines are affected?
Timeline for West Pharmaceutical Services
Mentioned in: A fifth filing, materiality still open
Cybersecurity: Threats and DefencesMentioned in: Alabama bank files a live-breach 8-K
Cybersecurity: Threats and DefencesFiled Form 8-K on 7 May declaring a 4 May ransomware incident material; took global operations offline
Cybersecurity: Threats and Defences: West Pharma SEC 8-K on ransomware haltBackground
West Pharmaceutical Services is a NYSE-listed (WST) US manufacturer of containment and delivery components for injectable drugs, headquartered in Exton, Pennsylvania. The company supplies pharmaceutical packaging, including rubber stoppers, seals and self-injection systems, to virtually every major global pharmaceutical manufacturer and biotechnology company, positioning it as a critical node in the pharmaceutical supply chain. Revenue for fiscal year 2025 was approximately $2.9 billion, and the company employs roughly 10,000 people across manufacturing facilities in North America, Europe and Asia-Pacific.
West Pharma filed a Form 8-K with the SEC on 7 May 2026, disclosing a material cybersecurity incident detected on 4 May, with data exfiltration and full-system encryption reported and operations taken offline globally. Palo Alto Networks Unit 42 was engaged as forensic responder; no ransomware group had publicly claimed responsibility at the time of filing, but the pattern is consistent with double-extortion ransomware .
The filing is significant as the second listed CNI-adjacent manufacturer, after Stryker's April 2026 8-K/A, to disclose material operational disruption without ransom-group attribution, establishing that the SEC's 2023 disclosure rule can be triggered by operational impact alone.