Amgen reports material cyber data breach

Amgen Inc. (AMGN) has reported a material cybersecurity incident involving unauthorized activity in cloud environments operated by third-party service providers. The company determined the incident met the threshold for material disclosure and described it in a recently filed Form 8-K. The disclosure centers on access to data stored in those external cloud systems, rather than to Amgen’s on-premise infrastructure.

The company said that some Amgen data appears to have been exfiltrated from the affected cloud environments. The information involved includes proprietary company data as well as patient protected health information. The scope and specific content of the affected files are still being investigated.

In its filing, Amgen stated that the volume and potential sensitivity of the affected files contributed to its conclusion that the incident is material. The reference to proprietary information indicates that internal business or scientific data may be among the compromised files. The inclusion of patient protected health information underscores the potential privacy implications of the breach.

The company has not yet provided a detailed breakdown of the data types or the number of affected individuals. Further clarification is expected as the investigation progresses and additional forensic analysis is completed.

Amgen reported that, as of the time of the Form 8-K filing, it had not identified any impact to its products, manufacturing operations, financial reporting systems or its ability to meet patient needs. The company stated that it currently believes the incident is not reasonably likely to have a material impact on its financial condition or results of operations. This assessment may be revisited as more information becomes available, but it frames the current view of business risk.

The lack of detected disruption to manufacturing or product supply suggests that the breach has been confined to data environments rather than core operational systems. Amgen has not indicated any changes to its financial guidance or operational plans in connection with the incident at this stage.

Following discovery of the unauthorized activity, Amgen activated its cybersecurity response plan and implemented containment measures in the affected cloud environments. The company engaged independent cybersecurity forensic experts to assist in investigating the incident and assessing the extent of the data exfiltration. These steps are aimed at understanding how the intrusion occurred, what information was accessed and what remediation is required.

Amgen is evaluating its regulatory and legal notification obligations arising from the breach. The company has indicated it will make required notifications, including to impacted patients where necessary, based on the findings of the ongoing investigation. Amgen plans to amend its Form 8-K and provide additional information as it becomes available, signaling that the disclosure process and incident response remain active.