West Pharmaceutical Services said it has contained a ransomware attack and is restarting critical systems, including manufacturing, receiving and shipping, at some of its facilities. The Exton, Pennsylvania-based company, one of the world's leading makers of drug-delivery devices and solutions, confirmed in a filing with the Securities and Exchange Commission that data was stolen and encrypted in the attack.
The company said it first noticed unusual activity on its network on May 4 and took systems offline globally as a precaution while it investigated. It determined on May 7 that the intrusion qualified as a material cybersecurity incident, the threshold that triggers a mandatory SEC disclosure filing, and has said the resulting disruption to business operations was global rather than confined to the sites now restarting production.
Containment measures included isolating affected on-premise infrastructure, restricting access to enterprise systems and notifying law enforcement. Palo Alto Networks' Unit 42 was brought in to lead incident response, working alongside other external experts and legal counsel. An assurance letter the company later shared states the ransomware attack was contained and that malicious binaries and unauthorized persistence mechanisms on its network were neutralized.
In its own update, West Pharmaceutical framed the recovery as underway but incomplete: "West is leveraging its business continuity plans and working with our customers to mitigate risk and minimize delays wherever possible." Core enterprise systems have been restored, and manufacturing, receiving and shipping have resumed at some sites, though the company has not set a timeline for full restoration.
What remains unknown is the cost. West Pharmaceutical has not determined the incident's financial impact and gave no estimate of how much data was exfiltrated or which categories of information were affected; the company says its investigation into the scope of the affected data is still active. It has also said it has taken steps meant to limit the risk that the stolen data is further disseminated, without detailing what those steps are. Before the attack, the company had forecast annual sales of $3.29 billion to $3.35 billion.
The episode adds to a run of manufacturing and healthcare-adjacent companies disclosing ransomware incidents with an operational dimension, not just a data-privacy one. West Pharmaceutical supplies devices and solutions used across the pharmaceutical industry, so an extended outage at its plants carries implications beyond the company's own balance sheet.
Leave a Reply