---
schema: 1
kind: incident
title: "West Pharmaceutical Services — 8-K/A confirms full operational restoration, data investigation ongoing"
headline: "West Pharmaceutical Services — 8-K/A confirms full operational restoration, data investigation ongoing"
summary: "UPDATE (originally covered 2026-W21): West Pharmaceutical Services (NYSE: WST) filed an 8-K/A amendment under SEC Item 1.05 on 2026-05-20 confirming full operational restoration across all manufacturing, supply chain, and commercial sites globally after the May 4 ransomware intrusion (SEC EDGAR 8-K/A, 2026-05-20)."
discovered_at: "2026-05-22T05:00:08Z"
event_date: 2026-05-20
run_id: 2026-05-22-5b90d5a1
priority: notable
immediate_action: null
tags:
  - ransomware
  - data-breach
regions:
  - us
sectors:
  - healthcare
  - manufacturing
entities: []
cves: []
sources:
  - url: "https://www.sec.gov/Archives/edgar/data/0000105770/000010577026000077/wst-20260507.htm"
    publisher: "SEC EDGAR 8-K/A West Pharmaceutical, 2026-05-20"
    role: primary
  - url: "https://www.cybersecuritydive.com/news/west-pharmaceutical-restoring-operations-ransomware-attack/820250/"
    publisher: "Cybersecurity Dive, 2026-05-14"
    role: corroborating
closed_sources: []
evidence: []
verification: multi-source
sourcing_note: "migration: update target unresolved (no originally-covered date in v2 body)"
confidence: high
update_of: null
references: []
deep_dive: false
deep_dive_category: null
org_triage: null
watchlist_hit: false
actions: []
migrated_from: briefs/2026-05-22.md
---

**UPDATE (originally covered 2026-W21):** West Pharmaceutical Services (NYSE: WST) filed an 8-K/A amendment under SEC Item 1.05 on 2026-05-20 confirming full operational restoration across all manufacturing, supply chain, and commercial sites globally after the May 4 ransomware intrusion ([SEC EDGAR 8-K/A, 2026-05-20](https://www.sec.gov/Archives/edgar/data/0000105770/000010577026000077/wst-20260507.htm)). No unauthorized activity observed since 2026-05-05. Data exfiltration scope and threat actor attribution remain under investigation; Palo Alto Networks Unit 42 is conducting the forensic response. The 8-K/A marks formal closure of the containment phase under the SEC's mandatory cyber-incident disclosure cycle; data impact scope will require a further disclosure when the investigation concludes.