01—Abstract
Summary
Summary of the 8-K filed May 11, 2026. Cited figures are marked; the original filing is the authoritative source.
West Pharmaceutical Services, Inc. (WST) filed a Current Report on Form 8-K under Item 1.05 (Material Cybersecurity Incidents) disclosing that on May 7, 2026, it determined it had experienced a material cybersecurity attack in which certain data was exfiltrated by an unauthorized party and certain systems were encrypted.
The company first detected an intrusion on May 4, 2026, and responded by taking systems offline globally for containment, notifying law enforcement, and engaging external cyber-forensic experts. The investigation into the nature and scope of the incident, including the extent of affected data, remains ongoing, and the company has taken steps intended to mitigate the risk of dissemination of the exfiltrated data. The incident and the company's response have temporarily disrupted business operations globally.
The company has restored its core enterprise systems, and critical shipping, receiving, and manufacturing processes have restarted at some sites, with restoration of the remaining sites in process. A timeline for complete restoration has not been finalized. The company states that the incident's material impact on its financial condition and results of operations, if any, has not been determined as of filing.
A website statement furnished as Exhibit 99.1 (dated May 11, 2026) adds that West engaged Palo Alto Networks' Unit 42 to support investigation, containment, and recovery, and that the company is leveraging business continuity plans and working with customers to mitigate risk and minimize delays. The company says it will continue to provide updates as more information becomes available.
02—Key points
Key Highlights
- Item 1.05 cybersecurity disclosure: On May 7, 2026, West determined it experienced a material cyberattack involving data exfiltration and system encryption.
- Detection and response: Intrusion first detected May 4, 2026; systems taken offline globally, law enforcement notified, and external cyber-forensic experts engaged.
- Operational disruption: Business operations were temporarily disrupted globally; core enterprise systems have been restored.
- Partial restart: Critical shipping, receiving, and manufacturing processes have restarted at some sites, with the remaining sites still being restored.
- No full restoration timeline: The company has not finalized a timeline for complete restoration of operations.
- Financial impact undetermined: The material impact on financial condition and results of operations, if any, has not been determined.
- Ongoing investigation: The scope, including the extent of affected data, remains under investigation; Palo Alto Networks' Unit 42 is supporting the response.
03—Questions
Frequently Asked Questions
What happened at West Pharmaceutical Services?
West disclosed a material cybersecurity attack in which an unauthorized party exfiltrated certain data and encrypted certain systems. The company first detected an intrusion on May 4, 2026, and determined on May 7, 2026 that the incident was material.
How is the attack affecting West's operations?
The incident and the company's containment response have temporarily disrupted operations globally. Core enterprise systems have been restored, and critical shipping, receiving, and manufacturing processes have restarted at some sites, with the remaining sites still being restored.
Has West quantified the financial impact of the incident?
No. The company states that the material impact on its financial condition and results of operations, if any, has not been determined as of the filing date.
When will operations be fully restored?
The company has not yet finalized a timeline for complete restoration of its operations.
What steps is West taking in response?
West shut down systems globally for containment, notified law enforcement, engaged external cyber-forensic experts including Palo Alto Networks' Unit 42, restricted access to enterprise systems, and is working with customers and using business continuity plans to minimize delays. The company says it has taken steps intended to mitigate the risk of dissemination of the exfiltrated data.
04—Continue