Amgen has disclosed a serious cloud-related data breach that exposed patient health information and proprietary company data, highlighting how third-party cloud services can become a weak point even for large biopharmaceutical firms. The company said it detected unauthorized activity in July 2026 and immediately activated its cybersecurity response plan, contained the incident, and brought in independent forensic experts to investigate.
According to Amgen’s filing, attackers exfiltrated data from cloud environments operated by third-party service providers. The stolen information reportedly included proprietary data, protected health information, and other records, while the company continues to determine whether confidential business information, intellectual property, research and development data, or additional patient data was also accessed.
Amgen has not identified which cloud providers were involved, how the compromise happened, or whether a known threat actor was responsible. It has also not disclosed how many people may be affected, but said the incident was considered material on July 29 after reviewing the volume of impacted files and the possibility that sensitive information was among them.
The company said it does not currently believe the breach is likely to materially affect its financial condition or operating results, and it has not seen an impact on products, manufacturing, financial reporting systems, or its ability to meet patient needs. Even so, the exposure of protected health information creates long-term privacy and compliance concerns, especially if personal medical or insurance details were included in the stolen files.
Amgen is still working with third-party cybersecurity experts and reviewing legal and regulatory notification requirements, including obligations under health privacy rules. The case is another reminder that cloud security is only as strong as the controls, monitoring, and vendor oversight behind it, and that incidents involving patient data can carry consequences long after the initial breach is contained.
Read the original article: