Amgen Reports Data Breach Exposes Protected Health Info

Amgen Inc., a major biotechnology and biopharmaceutical company headquartered in Thousand Oaks, California, disclosed a data breach involving unauthorized access to data stored in cloud environments hosted by third-party cloud service providers.

The company disclosed the breach to the U.S. Securities and Exchange Commission on July 29, 2026.

In July 2026, Amgen identified unauthorized activity involving data stored in cloud environments hosted by third-party cloud service providers. The breach involved data that was held in external cloud systems managed by outside providers.

The company reported the incident under Item 1.03 of Form 8-K, which is the section public companies use to disclose cybersecurity incidents that are considered material, meaning the company determined the breach could be significant enough to affect investors and the public.

The company's investigation found that data had been exfiltrated, or removed without authorization, from these third-party cloud environments. The types of information exposed included proprietary company data, patient protected health information and other information.

As of the date of the SEC filing, Amgen stated that it had not identified any impact to its products, manufacturing processes or the integrity of its data. The company noted that its investigation into the full scope of the incident remains ongoing.

Amgen's response to the breach

ABecause the investigation appears to be in its early stages, additional information about the full scope of the breach and any resources for affected individuals may be released in the weeks ahead.

Affected individuals should watch for future communications from Amgen that may provide more specific information about what data was involved and what steps the company is taking.