Loading story…
West Pharmaceutical Services disclosed a material cybersecurity incident after detecting suspicious activity on May 4 and determining by May 7 that an unauthorized actor had exfiltrated data and encrypted multiple internal systems. In an SEC filing, the pharmaceutical packaging and drug-delivery manufacturer said the attack disrupted parts of its global operations, including manufacturing, shipping, and enterprise functions. The company isolated affected systems, restricted enterprise network access, notified law enforcement, and brought in external incident-response support from Palo Alto Networks Unit 42 while recovery efforts continued.
West said some production and distribution systems have been restored and manufacturing has partially resumed, but the investigation is ongoing and the full scope of stolen data and financial impact remains unknown. No ransomware group has publicly claimed responsibility, though the combination of data theft and encryption matches double-extortion ransomware tactics that have repeatedly hit pharmaceutical manufacturers and broader healthcare supply chains, including earlier warnings from Indian drugmaker Sun Pharma that a ransomware attack could lead to revenue loss and litigation.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
West Pharmaceutical Services disclosed the incident as a material cybersecurity attack in an SEC filing. The company said some production and distribution systems had been restored and manufacturing had partially resumed while the investigation continued.
Following the discovery, West activated incident response and crisis management procedures, isolated affected systems, restricted enterprise access, notified law enforcement, and engaged external experts including Palo Alto Networks Unit 42.
By May 7, 2026, West determined that an unauthorized actor had exfiltrated data and encrypted multiple internal systems. The incident disrupted parts of its global operations, including manufacturing, shipping, and enterprise functions.
West Pharmaceutical Services detected suspicious activity on its network on May 4, 2026, prompting the company to begin investigating a cybersecurity incident.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cysecurity.news
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
West Pharmaceutical Services disclosed that attackers breached its network, stole data, and encrypted parts of its environment in a ransomware attack that disrupted global business operations. The Pennsylvania-based manufacturer said it detected the incident on May 4 and responded by shutting down and isolating affected on-premise infrastructure, restricting access to enterprise systems, notifying law enforcement, and bringing in Palo Alto Networks' Unit 42 to support containment, forensics, and recovery. The company said the attack affected critical systems used for shipping, receiving, and manufacturing products, though core enterprise systems have since been restored and some sites have resumed critical processes and partial manufacturing operations. West is still investigating what data was exfiltrated and whether the incident will have a material financial impact, and no ransomware group had publicly claimed responsibility at the time of reporting.
Jun 29, 2026
**UFP Technologies**, a Massachusetts-based medical device manufacturer, disclosed in an SEC filing that it detected suspicious activity on its IT systems on **February 14** and responded by isolating affected systems, engaging external cybersecurity experts, and launching an investigation. The company reported that the incident impacted **many but not all** IT systems and disrupted business functions including **billing** and **label making for customer deliveries**; it also stated that certain company or company-related data appears to have been **stolen or destroyed**. UFP said it believes the intruder has been **removed** from its environment and that access to impacted information has been restored “in all material respects,” with recovery supported by **contingency plans and backup systems**. Reporting noted that the combination of apparent data theft and destruction could indicate **ransomware or wiper-like activity**, though no malware family or threat actor has been publicly identified and **no ransomware group had claimed responsibility** at the time of publication; UFP also indicated it is still assessing whether **sensitive or personal information** was exfiltrated and expects **cyber insurance** to cover most incident-related costs.
Jun 29, 2026
**Ransomware and data-extortion activity** was reported across multiple sectors, with threat actors using leak sites to pressure victims and amplify impact. The **RansomHub** ransomware-as-a-service operation claimed it breached Chinese manufacturer **Luxshare** and stole sensitive manufacturing and R&D archives allegedly tied to major technology firms (including Apple, Nvidia, Tesla, and LG). The posted sample was described as containing engineering artifacts such as **3D CAD/Parasolid files, PCB manufacturing data, and engineering documentation**, plus some project-related PII; the breach had not been independently confirmed at the time of reporting. Separately, the **Everest** ransomware group claimed it breached **McDonald’s India**, alleging exfiltration of **861 GB** of internal documents and customer personal data and threatening publication if demands were not met; McDonald’s India had not confirmed the claim. In US healthcare, **Valley Eye Associates** confirmed a ransomware incident with **data exfiltration** during a short intrusion window, while **Qilin** publicly claimed responsibility and alleged **139 GB** stolen and posted—suggesting a non-payment outcome. A related but distinct development involved healthcare IT vendor **Veradigm**, which agreed to a **$10.5M** settlement tied to a prior (2024) breach affecting **2+ million** patients, underscoring ongoing legal and financial exposure following large-scale patient-data compromises.
Jun 29, 2026