Amgen Discloses Cloud Breach as Patient Health Data and Intellectual Property Are Stolen
Amgen said Friday that hackers broke into its cloud storage systems and made off with patient health information, proprietary company data, and intellectual property. The disclosure arrived in a securities filing with the US Securities and Exchange Commission, and it marks the latest in a string of cyberattacks aimed at some of the biggest names in biopharma.
The Thousand Oaks, California-based drugmaker told the SEC it first spotted unauthorized activity inside cloud storage hosted by external service providers back in July. Amgen says it moved quickly, activating its cybersecurity response plan and rolling out containment measures before calling in third-party digital forensics experts to figure out what happened.
That investigation turned up the bad news: sensitive data had been pulled out of the cloud environment. On July 29, Amgen concluded the incident was material enough to flag to the SEC, and it is now working through which patients need to be told, what regulators expect under HIPAA, and how far the exfiltration actually went.
The company has stressed that it has not seen any impact on its manufacturing, its products, its financial reporting, or its ability to keep delivering medicines to patients. Amgen also said it does not believe the breach is reasonably likely to hurt its financial position. Still, the full scope of what was stolen remains unclear, and the company admits it cannot put a firm number on the damage until its investigation wraps up.
What makes this one sting is what was exposed. Amgen builds biologic medicines for oncology, hematology, and cardiovascular disease, so the compromised records can include highly sensitive patient health information alongside confidential business plans and early-stage research. When that kind of material leaks, the value goes well beyond a few medical records. Trade secrets, clinical trial designs, and proprietary manufacturing data all become bargaining chips for whoever holds them.
A cloud environment, not a hardened fortress
The public details of this attack are still thin, and that is worth paying attention to. Amgen has not said which external provider ran the affected storage, how the intruders got in, or who Amgen believes is behind it. The FBI and other agencies have not named a suspect. What the filing does confirm is that the sensitive files were sitting in cloud storage operated by a third party, and that an unauthorized party found a way in.
That detail matters because a lot of companies treat "the cloud" as a set-and-forget solution. Data gets handed to a provider, encryption is assumed, and security is treated as someone else's problem. The reality is messier. Contractors and cloud vendors multiply the attack surface, and a misconfigured bucket, a stolen credential, or a vulnerable API can hand an attacker a door that the customer never knew existed. The Amgen filing hints at exactly this kind of sprawl, though the specifics have not been released.
For a company the size of Amgen, the response playbook is well established: contain, investigate, notify, and file. Amgen says it is reviewing the regulatory and legal notification requirements that apply, including its responsibilities under HIPAA. Affected patients will be contacted, though the company has not said how many or when.
Biopharma has become a favorite target
Amgen is not an outlier. The healthcare and life sciences sector has been hammered by data thieves all year, and the pattern is becoming hard to ignore.
Novo Nordisk was hit just weeks ago in an attack on its internal IT systems. Two extortion groups, FulcrumSec and TheUSERS007, tried to squeeze the Danish drugmaker for multi-million-dollar ransoms. That breach touched clinical trial participant information, and Novo reportedly turned down both ransom demands, telling affected patients to stay alert in case their data surfaces online. TheUSERS007 claimed its access came through a self-learning, adaptive AI engine it calls Venomware, though those claims have not been independently verified.
The list keeps growing. Medtronic, Stryker, and Abbott Laboratories have all dealt with security incidents or breach claims in recent months, as have West Pharmaceutical Services and a startup called Brainyx AI. The threat actors behind these episodes vary widely. Some run the straightforward data-theft-and-extortion playbook, squeezing companies for cash once they kidnap the files. Others look more political. The Iran-linked hacktivist group Handala has been tied to healthcare attacks, and ShinyHunters, a group that recently drew a warning from Health-ISAC, has piled up a string of successful hits on the sector.
Novartis offers an older but instructive case. Back in 2022, the Industrial Spy extortion group claimed it had stolen data tied to DNA- and RNA-based drug technologies and tried to sell it on dark web marketplaces. Novartis said at the time that no sensitive data was compromised, but the episode showed just how much value attackers place on biotech research.
The industry's exposure is a structural problem
Part of the reason biopharma keeps getting picked on is simple: the data is worth more there than almost anywhere else. A stolen credit card number loses value fast. A stolen drug patent, a set of clinical trial results, or a database of patients with rare diseases can be sold, ransomed, or weaponized for years.
There is also a trust problem baked into the model. Drugmakers hand vast amounts of research and patient data to cloud providers and contract research organizations, and every handoff is another place an attacker can strike. Amgen's own filing points at third-party-hosted storage, and the company has set up an AI Government Council and a cybersecurity and digital trust team to oversee how it adopts outside services. That governance exists precisely because the risk is now a board-level concern.
Regulators are watching too. The SEC has made clear it expects timely disclosure of material breaches, and Amgen's Form 8-K is exactly the kind of filing that follows. Health regulators are tightening the screws on how patient data is handled, and a company that drags its feet on notification can face penalties on top of the breach itself.
For patients, the practical risk is that stolen health information does not behave like a stolen credit card. You cannot cancel a medical condition or a genetic result. Once that data is out, it is out. Amgen's advice, echoed across the industry, is to watch for signs of fraud and to treat unsolicited contact about your medical data with suspicion.
What comes next
Amgen says its investigation into the full scope of the compromise is ongoing, and it has promised to notify affected patients once it knows more. Until then, the company is in the awkward position of confirming a material breach while being unable to say exactly what the attackers took or who sent them.
The episode is a reminder that the word "cloud" hides a physical reality: rows of rack-mounted storage arrays sitting in data centers, each holding disks full of sensitive records. When the locks fail on the digital side, all that hardware becomes a storage locker with a broken door.
Companies that handle large volumes of patient data would be wise to look closely at their own third-party arrangements, the same way Amgen is now auditing its own. Review who holds your data, what access they have, who can reach it, and whether you would know if a stranger already had. The breach at Amgen shows that even the biggest players, with dedicated security teams and a board-level governance council, can still be caught off guard.
The affected patients are waiting for answers, and so is the industry, which now has another case study in why cloud storage, for all its convenience, is only as safe as the weakest credential that reaches it.
Amgen's disclosure was reported first by Fierce Pharma, with additional detail on the SEC filing and HIPAA implications from the HIPAA Journal. For more on the threats facing connected systems and critical industries, see our ongoing coverage in Cybersecurity.