Six months after Merck & Co.'s manufacturing operations were crippled by a global cyberattack, the company says it has mostly recovered from the computer hack that took out its API production and affected its formulation and packaging systems, as well as R&D and other operations.
While those manufacturing problems are largely behind it, the Kenilworth, New Jersey-based company, like others, is now dealing with production interruptions in Puerto Rico after hurricanes there took out power, communications and transportation infrastructure.
“Other than sites in Puerto Rico, most of our manufacturing sites are now largely operational, meaning that we are manufacturing active pharmaceutical ingredient (API), formulating products and packing and shipping product,” a Merck spokeswoman said in an email.
RELATED: Merck targeted in global ransomware attack
Merck was the only pharma company to publicly acknowledge that it had systems affected by the Petya cyberattack in June, announcing it on Twitter. The attack infiltrated Microsoft systems that had not installed a needed security patch, taking control of computers and seeking a ransom in order for users to take back control. It had a worm-like capability that allowed it to spread across affected networks.
Merck has been provided few details but did acknowledge that its API manufacturing was knocked out. A month after the attack it was still evaluating the full impact but said that through a “significant effort,” it was able to keep clinical trials on track.
RELATED: Still reeling from cyberattack, Merck warns some drug supplies may be delayed
In its second-quarter earnings report the company said that it had largely restored its packaging operations and partially restored its formulation operations but was still unable to produce active pharmaceutical ingredients. The company was able to continue to supply products, although it warned clients to expect some supply interruptions.
By the third quarter, Merck had a better idea of the financial tab from the attack. While it generally had a very solid quarter, the results were dampened by the impact of the attack. There were $300 million in lost sales and costs.
One obvious effect was on its star HPV vaccine, which fell 22% and missed sales expectations by $100 million. On top of that, unable produce enough Gardasil to meet demand, it was forced to borrow doses from the CDC's stockpile to fulfill orders. That cost $240 million that it said would be recovered as it was able to replenish the CDC stores. Merck has told investors that its expects to take see a similar financial hit in Q4 as the financial effects of the attack linger.
Topping it off, members of Congress were concerned enough about the reports that they asked Merck CEO Kenneth Frasier to report to the House Committee on Energy and Commerce about the impact of the attack on its ability to produce products and serve patients.
In Puerto Rico, where Merck has one facility making a limited number of products, it is—like dozens of other drug manufacturers—waiting on the government and utilities to restore power and communications networks so that full production can be restored.