Loading story…
West Pharmaceutical Services disclosed that attackers breached its network, stole data, and encrypted parts of its environment in a ransomware attack that disrupted global business operations. The Pennsylvania-based manufacturer said it detected the incident on May 4 and responded by shutting down and isolating affected on-premise infrastructure, restricting access to enterprise systems, notifying law enforcement, and bringing in Palo Alto Networks' Unit 42 to support containment, forensics, and recovery.
The company said the attack affected critical systems used for shipping, receiving, and manufacturing products, though core enterprise systems have since been restored and some sites have resumed critical processes and partial manufacturing operations. West is still investigating what data was exfiltrated and whether the incident will have a material financial impact, and no ransomware group had publicly claimed responsibility at the time of reporting.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
By the time of public reporting on May 12-13, 2026, West said core enterprise systems had been restored and some critical processes and affected sites had restarted operations. The company continued investigating the breach while determining the extent of data theft and business impact.
On May 7, 2026, West Pharmaceutical disclosed the ransomware incident in an SEC filing, stating that data had been stolen and systems encrypted. The filing said the company was still assessing the scope of compromised data and the potential financial impact.
Following detection of the attack, West proactively shut down and isolated affected on-premise infrastructure, restricted access to enterprise systems, and notified law enforcement. The company also engaged Palo Alto Networks Unit 42 and other external incident response experts to investigate, contain, and remediate the incident.
On May 4, 2026, West Pharmaceutical Services detected a cyberattack in which an intruder breached its network, exfiltrated data, and encrypted certain systems. The incident disrupted global operations, including systems supporting shipping, receiving, and manufacturing.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcebleepingcomputer.com
Open sourcetherecord.media
Open sourceinvestor.westpharma.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
West Pharmaceutical Services disclosed a material cybersecurity incident after detecting suspicious activity on May 4 and determining by May 7 that an unauthorized actor had exfiltrated data and encrypted multiple internal systems. In an SEC filing, the pharmaceutical packaging and drug-delivery manufacturer said the attack disrupted parts of its global operations, including manufacturing, shipping, and enterprise functions. The company isolated affected systems, restricted enterprise network access, notified law enforcement, and brought in external incident-response support from **Palo Alto Networks Unit 42** while recovery efforts continued. West said some production and distribution systems have been restored and manufacturing has partially resumed, but the investigation is ongoing and the full scope of stolen data and financial impact remains unknown. No ransomware group has publicly claimed responsibility, though the combination of data theft and encryption matches **double-extortion ransomware** tactics that have repeatedly hit pharmaceutical manufacturers and broader healthcare supply chains, including earlier warnings from Indian drugmaker Sun Pharma that a ransomware attack could lead to revenue loss and litigation.
Jun 29, 2026
**Advantest**, a major semiconductor chip-testing company, was reported as being **hit by ransomware**, indicating a disruptive cyber incident affecting a critical supplier in the semiconductor manufacturing ecosystem. Public reporting did not provide detailed technical indicators, the initial access vector, or the scope of impacted systems, but the incident aligns with ongoing ransomware targeting of large enterprises and operationally critical technology providers. Separate reporting during the same period emphasized that ransomware operators and initial access brokers frequently gain entry via **network edge devices**, particularly **firewalls** exploited through known vulnerabilities or compromised accounts, and that legacy exposures can remain in active use for years. This broader trend context is consistent with ransomware tradecraft but is not specific attribution or confirmation of the intrusion method used against Advantest.
Jul 12, 2026
**Advantest Corporation** reported a cybersecurity incident in which an unauthorized party appears to have accessed parts of its network and **deployed ransomware**, impacting certain internal systems. The company said it detected unusual activity on **Feb. 15 (JST)**, activated incident response procedures, **isolated affected systems**, and engaged third-party cybersecurity specialists to support investigation and containment; the investigation remains ongoing and findings may change as more facts are confirmed. Public reporting echoed Advantest’s statement that the scope and responsible ransomware group are **not yet identified**, and noted the broader trend of increased ransomware targeting of industrial and manufacturing organizations, including the semiconductor sector. Advantest stated it will provide updates and, if the investigation determines **customer or employee data** was affected, it will notify impacted individuals directly with guidance on protective measures.
Jun 29, 2026