Industrial Cyber reported on May 14, 2026 that ransomware attacks have struck West Pharmaceutical Services, a leading maker of packaging and delivery components for injectable medicines, and Foxconn, the world’s largest contract electronics manufacturer. The report frames the two incidents as the latest evidence of escalating cyber risk across the manufacturing sector.

Details disclosed so far are limited: the coverage identifies the victims and the ransomware nature of the attacks, but public reporting at publication time did not attribute the incidents to a named threat group or quantify production impact at either company.

Executive Summary

Two manufacturers with very different profiles — a critical supplier to the pharmaceutical supply chain and the assembly backbone of the global electronics industry — have been named as ransomware victims in the same news cycle. That pairing is the story: ransomware operators are not targeting one niche, they are working the entire manufacturing sector, from regulated medical-component plants to high-volume electronics lines.

For readers outside the industry, ransomware is malicious software that encrypts a victim’s systems and demands payment for restoration, increasingly paired with the theft of data as a second lever of extortion. Manufacturing is uniquely exposed because factory downtime is immediately and visibly expensive, which gives attackers leverage that they do not have against victims who can operate degraded for weeks.

The incidents matter beyond the two companies. West’s components sit inside injectable drug supply chains where substitution is slow and regulated; Foxconn sits upstream of much of the consumer electronics market. When suppliers of this scale are disrupted, the effects propagate to customers who never signed a contract with the attackers’ victim.

Why Factories Became Ransomware’s Favorite Target

Multiple industry threat reports in recent years have ranked manufacturing among the most-attacked sectors, and the economics explain why. A manufacturer’s revenue is tied to physical throughput: when systems go down, production stops, contractual delivery penalties accrue, and perishable or time-sensitive processes can be ruined. That creates urgency, and urgency is what ransomware operators monetize. A law firm can work from paper for a week; a filling line cannot.

Manufacturers also tend to carry more legacy technology than sectors like banking. Plant-floor systems are often validated against specific, older software versions, are expensive to take offline for patching, and were designed for decades of service in an era when they were never expected to face the internet. Attackers know this, and the steady drumbeat of manufacturing victims suggests the sector’s defensive posture has not yet caught up with its attractiveness.

IT Attacks With OT Consequences

Operational technology (OT) is the hardware and software that controls physical processes — the controllers, sensors, and industrial PCs that run production lines — as distinct from IT, the business systems handling email, finance, and orders. A recurring pattern in manufacturing ransomware is that attackers never need to touch OT directly. Encrypting the IT side — order management, scheduling, logistics, quality records — is often enough to halt production, and many manufacturers shut lines down preemptively to keep an infection from spreading into plant networks.

This is why the standard defensive prescription centers on segmentation: architecting networks so that a compromise of business systems cannot reach, and does not force the shutdown of, the systems that make product. The reported incidents at West and Foxconn will be worth watching on exactly this dimension — whether production systems were directly affected or idled as a precaution — though the current reporting does not yet answer that question.

Two Very Different Victims, One Lesson

West Pharmaceutical operates in one of the most regulated corners of manufacturing. Its elastomer stoppers, seals, and syringe components are qualified into specific drug products, meaning pharmaceutical customers cannot simply switch suppliers if output is disrupted; requalification is measured in months. An attack on a company in that position carries potential public-health stakes that an attack on a discretionary-goods maker does not, and it illustrates why ransomware against healthcare-adjacent supply chains draws particular scrutiny from regulators and governments.

Foxconn, by contrast, is a repeat entrant in the ransomware record: its Ciudad Juárez facility was hit by the DoppelPaymer group in 2020, and its Tijuana plant was struck by LockBit in 2022. A third reported incident at the world’s largest electronics contract manufacturer raises a fair question in both directions — whether even well-resourced global manufacturers can realistically defend attack surfaces spanning hundreds of facilities, and whether the sector’s investment in OT-aware security has matched the rhetoric that followed earlier incidents. The honest answer from the available evidence is that scale cuts both ways: it funds security programs, and it multiplies the doors an attacker can try.

The Business Calculus for Everyone Downstream

For manufacturing executives and boards, incidents like these keep shifting cyber risk from an IT line item to an operational and disclosure issue. U.S.-listed companies must now publicly disclose cyber incidents they determine to be material, which means production-halting ransomware increasingly plays out in front of investors rather than quietly behind incident-response retainers.

For customers of large suppliers, the practical takeaway is that supplier cyber resilience is now a procurement criterion on par with financial health. Buyers of critical components — whether drug packaging or electronics assembly — are increasingly asking for evidence of network segmentation, tested recovery times, and OT-specific monitoring, because the alternative is discovering a supplier’s weaknesses only when a line goes dark.

Background

West Pharmaceutical Services, headquartered in Exton, Pennsylvania, has supplied containment and delivery components for injectable drugs for over a century and serves most of the world’s major pharmaceutical manufacturers. Foxconn, founded in Taiwan in 1974, grew into the world’s largest electronics contract manufacturer and a linchpin of global consumer-electronics supply chains, with major operations across Asia and the Americas.

Both sit inside a broader trend: as factories connected legacy control systems to corporate networks and the internet over the past two decades, manufacturing rose to the top tier of ransomware victimology. High-profile precedents — from Norsk Hydro’s 2019 plant disruptions to Foxconn’s own 2020 and 2022 incidents — established that production downtime, not just data, is what extortionists monetize in this sector.

Source: Ransomware attacks on West Pharmaceutical and Foxconn highlight growing cyber risks to manufacturing sector — Industrial Cyber’s May 14, 2026 report on ransomware incidents at the two manufacturers and the sector-wide threat trend they illustrate.