1 technique observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.1 · compare on the matrix · Navigator layer (JSON)
ImpactData Encrypted for Impact
Impact TA0040
T1486Data Encrypted for Impact×1
Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
West Pharmaceutical Services determined on 2026-05-07 that it had suffered a material cybersecurity attack in which an unauthorized party exfiltrated data and encrypted some systems; after detecting the intrusion on 2026-05-04 it took systems offline globally, notified law enforcement and engaged external forensic experts, and the 8-K filed on 2026-05-11 says the business was disrupted globally, core enterprise systems were restored and shipping, receiving and manufacturing had restarted at some sites, with no timeline yet for complete restoration and no access vector or exfiltration method stated (SEC 8-K, 2026-05-11). The company, which specialises in injectable drug packaging, syringe and vial components, containment systems and drug delivery devices, engaged Palo Alto Networks' Unit 42 for incident response, and no ransomware group had taken credit as of 2026-05-13 (BleepingComputer, 2026-05-13).
On May 7, 2026, West Pharmaceutical Services, Inc. (the “Company”) determined that the Company has experienced a material cybersecurity attack, in which certain data was exfiltrated by an unauthorized party and certain systems were encrypted.
While the Company has restored its core enterprise systems, and critical processes for shipping, receiving, and manufacturing have restarted at some sites with restoration of the remaining sites in process, the timeline for a complete restoration has not yet been finalized.
The 8-K says that data was exfiltrated and some systems encrypted, but not how the data left or how the attacker got in, and that the investigation into the scope and the data affected was ongoing (SEC 8-K, 2026-05-11). No ransomware group had taken credit as of 2026-05-13, and West specialises in injectable drug packaging, syringe and vial components, containment systems and drug delivery devices (BleepingComputer, 2026-05-13); no cited source describes which European supply lines depend on it or what detection preceded the encryption.
incident12 May 05:00Zsingle-source · victim disclosureOpen finding →