Amgen says hackers stole patient health data in cloud breach

Amgen said hackers stole company data and patient health information from cloud storage systems run by third-party providers, putting sensitive medical records at the center of a material cybersecurity breach. The Thousand Oaks, California, biotechnology company filed a Form 8-K with the U.S. Securities and Exchange Commission and listed July 29, 2026 as the earliest event reported.

Amgen said proprietary data and protected patient health information were exfiltrated from a cloud environment. The company did not disclose how many patients or records were affected, leaving open the scale of exposure even as it moved to notify regulators and assess the damage. Amgen also described the incident as material because of the volume and sensitivity of the data involved.

The stakes are higher when the stolen files include health information. Medical data can expose details about a person's condition, treatment and identity, and once it is taken, it can be used for fraud, extortion or long-term privacy harm. For patients, the loss is not just a technical event. It can mean years of risk tied to information that cannot be changed the way a password can.

The breach also highlights how much of modern drug development and patient data handling now depends on outside vendors. Amgen's public company materials say it uses biology, technology and human genetic data in its work, which makes cloud security and third-party oversight part of the company's core responsibility. A failure in that chain can expose protected information even if the attack does not begin inside Amgen's own network.

Amgen has faced vendor-linked exposure before. A Maryland attorney general filing dated Aug. 23, 2023 said the company notified regulators that a breach involving Sirva Relocation, LLC may have affected the personal information of five Maryland residents, and a California notice said Sirva became aware of suspicious activity on or about Sept. 29, 2023. A California attorney general notice says Amgen warned again in September 2024 about the Sirva breach.

Breaches involving patient health data can trigger mandatory notices, regulatory scrutiny and lawsuits, while also making patients and providers more cautious about how information is shared. For Amgen, the question now is whether its response matches the higher standard expected of a company handling sensitive medical data through a web of third-party cloud systems.