"Complete data inventory is what allows an organization to answer the first question every board and every regulator will ask after a breach. What was taken." — Jacob Krell, Senior Director: Secure AI Solutions & Cybersecurity, Suzu Labs
West Pharmaceutical: discovery and immediate response
West Pharmaceutical Services disclosed on May 7 that it had experienced a cyberattack. The company identified a network systems issue and on May 4 determined the cause to be a cyberattack, triggering its incident response protocols. West engaged law enforcement and retained third‑party cyber‑forensic experts as part of that response, according to the company’s disclosures.
Data exfiltration: admitted loss, uncertain scope
West has acknowledged that certain data was exfiltrated but is still working to determine the extent of the affected data. That uncertainty sits at the center of the public record: the company’s filings and outside commentary both emphasize that organizations frequently know which systems are down but struggle to inventory precisely what data lived on those systems and who it affects. Jacob Krell framed that gap as a familiar, systemic problem: without a complete data inventory, an organization cannot promptly answer the first substantive question posed by boards and regulators — what was taken.
Operational disruption and phased recovery
On May 11 West announced that incident response measures had temporarily disrupted global operations, including essential processes for shipping, receiving, and manufacturing. By May 13 the company reported that enterprise systems had been restored and that some shipping, receiving and manufacturing processes had restarted — but not all operations were yet back to full capacity. The company’s timeline shows a sequence common to major cyber incidents: detection, containment and external engagement followed by a gradual, phased return of services rather than an immediate resumption of full production.
Effects on injectable drug supply and proprietary packaging (Damon Small, Xcape, Inc.)
Damon Small of Xcape, Inc. described the attack as striking the "sterile core" of the global drug supply chain. He said the attackers’ actions forced a proactive global shutdown of manufacturing and shipping, which he asserts “paralyzed the delivery mechanism for approximately 70% of the world’s injectable drugs.” Small argued the incident illustrates two linked risks: operational paralysis caused by a precautionary shutdown and the quieter threat of extortion targeting proprietary intellectual property. He notes the absence of a public leak site listing — an observable detail — and interprets that as an indicator West may be negotiating to protect specialized packaging designs and shipping manifests that Small says represent a single point of failure for companies such as Pfizer and Moderna. Small also emphasized that restoring enterprise systems is only half the task; the phased restart of factories, he said, reveals distrust in operational‑technology segmentation after a corporate IT breach reached production lines.
How technologists, regulators, and pharmaceutical customers are responding
- Technologists and security teams: the incident spotlights the data‑inventory problem and questions about IT‑to‑OT segmentation. Security responders will be focused on forensic answers to what was exfiltrated and whether corporate systems contamination extended into production environments.
- Regulators and company boards: consistent with Jacob Krell’s observation, boards and regulators will prioritize definitive answers to what data was taken and the materiality of that loss as West’s investigation continues.
- Pharmaceutical customers such as Pfizer and Moderna: Damon Small singled out specialized packaging designs and shipping manifests as potential targets; those customers will be watching both data‑loss findings and the pace of the phased manufacturing restart for impacts on injectable drug deliveries.
The record as presented shows an attack that moved beyond a localized IT outage to a broader operational challenge: enterprise systems restored, work resuming in stages, but core questions unanswered about the scope of exfiltrated data and the integrity of processes that handle sterile, time‑sensitive products. West has involved law enforcement and third‑party forensics; the next public milestones will be the company’s inventory of what was taken and the completion of factory restarts. Those facts will determine whether the incident is remembered primarily as a temporary operational disruption or as a more enduring breach of trust in the controls that underpin a critical segment of the drug supply chain.
Original reporting: https://www.securitymagazine.com/articles/102300-expert-insights-on-the-west-pharmaceutical-ransomware-attack
