Amgen

Amgen detected unauthorized activity in July 2026, activated its cybersecurity response plan, implemented containment measures, and engaged independent forensic experts. The company determined the incident material on July 29 and announced it publicly on July 31, 2026.

Investigators confirmed that attackers exfiltrated proprietary data, patient protected health information, and other sensitive information from cloud environments operated by third-party service providers. Amgen has not disclosed which providers were involved, how the environments were compromised, how many individuals may be affected, or whether the activity is linked to a known threat actor. The company says it plans to notify affected patients.

Confirmed by the company: proprietary data, patient protected health information, and other sensitive information. Amgen is still assessing whether confidential business information, intellectual property, or additional patient data was accessed. Specific data elements have not been publicly enumerated.

Biopharmaceutical PHI is a distinct category and the distinction matters here. It generally arrives through patient support programs, copay assistance, adverse event reporting, and clinical registries — mechanisms that exist to help patients access and stay on a specific therapy. Which means the record itself encodes the diagnosis. Knowing that a named person is enrolled in the support program for a particular biologic tells you what disease they have, with no clinical notes required.

Patients on Amgen therapies, many of whom are being treated for cancer, cardiovascular disease, or serious inflammatory and bone conditions. These are not incidental data subjects; they enrolled in programs precisely because they needed help affording or managing a serious illness.

The exposure is inherently diagnostic and cannot be undone. A Social Security number can be monitored and a card reissued; a disclosed diagnosis is permanent. The realistic harms are targeted extortion, insurance and employment discrimination in jurisdictions where protections are weak, and highly credible phishing — a message referencing the correct drug, the correct program, and the correct patient is extremely difficult to distrust when you depend on that program.

The proprietary data and IP exposure lands on Amgen's shareholders and, over a longer horizon, on the economics of drug development. Those are real, but they are not the harm that needs naming first.

Amgen's response was, on the visible record, textbook. Detection occurred, the response plan activated immediately, containment was deployed, independent forensics were engaged, materiality was assessed within days, and public disclosure followed two days after that determination. Few companies execute that sequence as cleanly.

The reasonable assumption underneath is that using established third-party cloud service providers transfers a portion of the risk. It transfers operational responsibility for the infrastructure. It transfers none of the accountability for the data. When a vendor's environment is compromised, the notification obligation, the regulatory exposure, and the patient relationship all remain with Amgen — and the forensic visibility does not.

"The company is still assessing the full scope of the breach, including whether confidential business information, intellectual property, or additional patient data was accessed." That sentence is honest, standard, and diagnostic. It says the organization is determining, after the fact, what its vendors were holding on its behalf.

Note the shape of what is unknown: not just how many patients, but which categories of data were present at all. Pharmaceutical companies distribute data across cloud environments by function — a patient support vendor here, a registry platform there, an analytics environment somewhere else — each scoped at contract signing and each drifting afterward. No single map spans them.

Amgen detected the intrusion quickly and disclosed responsibly. What it could not do quickly was say what was taken, because that answer lived in someone else's infrastructure and had never been consolidated into a form the company could query.

Two regulatory clocks are running on different logic. The HIPAA Breach Notification Rule requires notification of affected individuals without unreasonable delay and no later than 60 days from discovery, with breaches of 500 or more individuals reported to the HHS Office for Civil Rights and posted to the OCR breach portal. SEC rules require disclosure of a material cybersecurity incident within four business days of the materiality determination — which is why July 29 and July 31 are two days apart.

The SEC clock has already been satisfied. The HIPAA clock cannot be, because notifying patients requires knowing which patients, and that determination depends on forensic work inside third-party environments that Amgen does not control and cannot unilaterally search. Add 50 state statutes, GDPR for any EU patients in global programs, and the practical reality that adverse event data carries FDA implications of its own. Amgen also has to be able to describe the exposure to its vendors' other clients' satisfaction, because those companies are now asking the same questions.