Amgen Reports Patient Data Breach from Cloud Systems

Amgen, the American biotechnology company that develops treatments for oncological, cardiovascular, inflammatory and rare diseases, has reported a data breach. Attackers stole corporate information and patient data held in several cloud systems that were maintained by third-party providers.

What happened

The company discovered the unauthorized activity in July 2026. In response, Amgen activated its cyber incident response plan, took steps to contain the breach, and brought in independent digital forensics experts. The investigation revealed that the attackers had managed to exfiltrate sensitive data from the cloud environments.

In a Form 8-K filed with the U.S. Securities and Exchange Commission (SEC), the company stated that the stolen material included proprietary data, protected health information belonging to patients, and other information. Amgen is still working to determine whether confidential business information, intellectual property, and research and development data were also affected.

The scope remains unclear

The company has not disclosed which third-party cloud providers were affected, how the environments were compromised, how many people may have been impacted, or whether the attack is linked to any known group. On July 29, Amgen deemed the incident material — a conclusion reached after assessing the volume of potentially affected files and the likelihood that they contained sensitive information.

At the same time, Amgen notes that, based on its current assessment, the incident is unlikely to have a material impact on its financial position or operating results. The company is continuing its investigation with the involvement of outside cybersecurity specialists, is reviewing notification requirements under the law, and intends to notify affected patients where necessary.

BleepingComputer sent Amgen questions about whether the incident was connected to a vishing attack on an employee's single sign-on (SSO) account, which cloud services were affected, and whether the company had been approached by extortionists claiming to be the ShinyHunters group. No response had been received by the time of publication. Health-ISAC had previously warned of a rise in ShinyHunters attacks aimed at stealing data in the healthcare sector.

Source: Bleeping Computer