Amgen discloses material cloud data breach exposing patient and proprietary data (2026)

On 29 July 2026, Amgen — one of the world's largest biotechnology companies — disclosed in a filing with the U.S. Securities and Exchange Commission that it had suffered a material cybersecurity incident in which attackers exfiltrated data, including patient protected health information and proprietary company information, from cloud environments operated by third-party providers.

What happened

Amgen said it had identified the unauthorized activity earlier in July and responded by activating its cybersecurity incident-response plan, putting containment measures in place and engaging independent forensic experts. The compromised data resided in cloud environments run by third-party providers rather than on Amgen's core internal systems, once again highlighting the risk that third-party and cloud infrastructure poses to even the best-resourced enterprises.

The company confirmed that some of its data — including proprietary data, patient protected health information, and other information — had been exfiltrated, and said its investigation into whether additional confidential business data, intellectual property, or research-and-development material was accessed remained ongoing.

Impact and response

Amgen stated that, as of disclosure, it had not identified any impact to its products, manufacturing operations, financial reporting, or delivery of medicines to patients. Nevertheless, under U.S. securities rules the company judged the incident material — a determination it reached on 29 July — and reported it accordingly. Given the exposure of patient health information, the breach also carries notification obligations under U.S. health-privacy law.

Why it matters

For a company whose value is anchored in patient data and closely guarded research, the theft of protected health information and proprietary material is a serious event even without operational disruption. Amgen's disclosure is part of a broader 2026 pattern in which attackers increasingly bypass hardened corporate networks by targeting the third-party cloud platforms that large enterprises rely on to store and process sensitive data.