Cybersecurity incident disclosed by WEST PHARMACEUTICAL SERVICES INC in a Form 8-K (May 2026)

Material Cybersecurity Incidents. On May 7, 2026, West Pharmaceutical Services, Inc. (the “Company”) determined that the Company has experienced a material cybersecurity attack, in which certain data was exfiltrated by an unauthorized party and certain systems were encrypted. Upon initial detection of an intrusion on May 4, 2026, the Company promptly activated its incident response protocols, including proactively taking systems offline globally for containment purposes, notifying law enforcement, and engaging external cyber-forensic experts. The Company’s investigation into the nature and scope of the incident remains ongoing, including the extent of the data affected. The Company has taken steps intended to mitigate the risk of dissemination of the exfiltrated data. The incident and the Company’s proactive response have temporarily disrupted the Company’s business operations globally. While the Company has restored its core enterprise systems, and critical processes for shipping, receiving, and manufacturing have restarted at some sites with restoration of the remaining sites in process, the timeline for a complete restoration has not yet been finalized. The incident’s material impact on the Company’s financial condition and results of operations, if any, has not been determined at the time of filing. Forward-Looking Statements This Current Report on Form 8-K contains forward-looking statements within the meaning of the Private Securities Litigation Reform Act of 1995, including, but not limited to, statements regarding the Company's expectations regarding future events, actions or performance related to the cybersecurity incident, including the results of the Company’s ongoing investigation thereof and the impact of the cybersecurity incident on the Company, and its financial or operational performance. Forward-looking statements may be identified by words such as "believe," "expect," "intend," "estimate," "plan," "anticipate," "project," "forecast,"…

Material Cybersecurity Incidents. As previously disclosed in the Original Report, the Company determined on May 7, 2026 that the Company had experienced a material cybersecurity attack, in which certain data was exfiltrated by an unauthorized party and certain systems were encrypted. Upon initial detection of an intrusion on May 4, 2026, the Company promptly activated its incident response protocols, including proactively taking systems offline globally for containment purposes, notifying law enforcement, and engaging external cyber-forensic experts. Remediation efforts have since progressed, with core enterprise systems restored in addition to critical processes for manufacturing, receiving and shipping restarted at all sites. The Company is now fully operational across its manufacturing, supply chain and commercial sites globally. While the Company’s investigation into the nature and scope of the incident is continuing, including with respect to the extent of the data affected, no unauthorized activity or access is ongoing or has been observed since May 5, 2026. Based on the investigation to date and information currently available, the Company believes that the incident has not had, and is not reasonably likely to have, a material impact on the Company’s 2026 second-quarter and full-year financial guidance. Forward-Looking Statements This Current Report on Form 8-K contains forward-looking statements within the meaning of the Private Securities Litigation Reform Act of 1995, including, but not limited to, statements regarding the Company's expectations regarding future events, financial guidance, actions or performance related to the cybersecurity incident, including the results of the Company’s ongoing investigation thereof and the impact of the cybersecurity incident on the Company, and its financial or operational performance. Forward-looking statements may be identified by words such as "believe," "expect," "intend," "estimate," "plan," "anticipate,"…