Expert Insights on the West Pharmaceutical Ransomware Attack

"A network systems issue was identified, and on May 4, the company determined it to be the result of a cyberattack. The organization enacted incident response protocols, engaged law enforcement, and reached out to third-party cyber-forensic experts."

"The company has determined that certain data was exfiltrated, but it is still working to determine the extent of that affected data. Likewise, investigations continue to try and understand the nature and scope of the incident."

"West's SEC filing notes the company is still investigating what data was compromised. That uncertainty is a data inventory problem, and most organizations share it regardless of sector. They can tell you systems are down. Fewer can tell you exactly what data sat in those systems and who it affects. That gap extends every phase of incident response from materiality determination to customer notification. Complete data inventory is what allows an organization to answer the first question every board and every regulator will ask after a breach. What was taken."

"The West Pharmaceutical attack is a direct hit on the 'sterile core' of the global drug supply chain. By forcing a proactive global shutdown of manufacturing and shipping, the attackers didn't just lock servers; they paralyzed the delivery mechanism for approximately 70% of the world's injectable drug"

West Pharmaceutical Services identified a network systems issue and determined on May 4 that it resulted from a cyberattack. Incident response protocols were activated, law enforcement was engaged, and third-party cyber-forensic experts were brought in. The company determined that certain data was exfiltrated, while continuing to determine the extent and nature of the affected data. Investigations continued to understand scope and impact. On May 11, response measures temporarily disrupted global operations, including shipping, receiving, and manufacturing processes. By May 13, enterprise systems were restored and some processes were restarted, though not all operations returned to full capacity.

Read at Securitymagazine