West Pharmaceutical Took Global Systems Offline After Intrusion

West Pharmaceutical Services, which manufactures containment and delivery components for injectable drugs, detected an intrusion on or about 4 May 2026 and shut down systems globally. Reporting describes both exfiltration and encryption.

From the outside, a global shutdown reads as catastrophe. Inside an incident, it is frequently the least bad option available, and it is a decision rather than an outcome.

A responder who cannot yet bound an intruder’s reach has two choices. Leave systems running and accept that encryption or exfiltration may continue while the picture improves, or disconnect and accept certain operational loss in exchange for a hard stop.

The first option preserves revenue and risks an unbounded outcome. The second guarantees a bounded, expensive one. Organisations that shut down quickly generally have two things: an accurate sense of how bad it could get, and enough authority in the room to act before the picture is complete.

The pharmaceutical supply chain adds a second clock. Components for injectable medicines have qualification requirements that make substitution slow, so downtime propagates to customers who cannot simply source elsewhere. That raises the cost of the shutdown and the cost of not shutting down at the same time.

We would rather read a disclosure that says “we disconnected everything on day one” than one that describes a measured, staged response ending in a leak-site listing six weeks later.