--- title: Amgen says cloud data breach exposed patient health,... description: Pharmaceutical giant Amgen disclosed a data breach in which threat actors exfiltrated sensitive data — including patient protected health information and... canonical: https://daily.dev/posts/amgen-says-cloud-data-breach-exposed-patient-health-proprietary-info-squzyz7bh twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Amgen says cloud data breach exposed patient health, proprietary info | daily.dev og:description: Pharmaceutical giant Amgen disclosed a data breach in which threat actors exfiltrated sensitive data — including patient protected health information and... og:url: https://daily.dev/posts/amgen-says-cloud-data-breach-exposed-patient-health-proprietary-info-squzyz7bh og:image: https://api.daily.dev/og/posts/SQUzyZ7BH.png og:image:alt: Amgen says cloud data breach exposed patient health, proprietary info og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Amgen says cloud data breach exposed patient health, proprietary info **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 2 min read · 1 upvotes · 1 comments ## Summary Pharmaceutical giant Amgen disclosed a data breach in which threat actors exfiltrated sensitive data — including patient protected health information and proprietary corporate data — from cloud environments managed by third-party service providers. The breach was detected in July 2026, prompting activation of a cybersecurity response plan, containment measures, and engagement of independent forensic experts. Amgen filed a Form 8-K with the SEC after determining the incident was material, though it does not currently expect a material financial impact. The company has not disclosed which cloud providers were affected, the attack vector, or the number of impacted individuals. BleepingComputer noted possible links to a vishing attack and the ShinyHunters threat group, but Amgen has not confirmed these details. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What happened in the Amgen cloud data breach? Threat actors stole corporate and patient data from multiple cloud environments operated by third-party service providers used by Amgen. The pharmaceutical company detected the unauthorized activity in July 2026, activated its cybersecurity response plan, and confirmed that proprietary data and patient protected health information were exfiltrated. Amgen is still investigating whether additional business, intellectual property, R&D, or patient data was also accessed. _Security teams tracking healthcare breach disclosures like this can follow developments on daily.dev._ ### Has Amgen said which cloud providers or attackers were involved in its data breach? No, Amgen has not disclosed which third-party cloud providers were compromised, how the environments were breached, how many people were affected, or whether the attack is linked to a known threat actor. Reporters have asked whether the breach involved a vishing attack on an employee's single sign-on account and whether the extortion group ShinyHunters was involved, but Amgen had not responded at the time of disclosure. _Anyone monitoring supply chain and SaaS breach attribution can track updates on daily.dev._ ### Why did Amgen determine its 2026 data breach was a material event under SEC rules? Amgen determined on July 29, 2026 that the breach was material after evaluating the volume of potentially impacted files and the likelihood they contained sensitive information, disclosing it via an SEC Form 8-K filing. Despite the materiality determination, Amgen stated it does not currently believe the incident is reasonably likely to materially affect its financial condition or operating results. _Developers and compliance teams weighing breach materiality thresholds can follow such disclosures on daily.dev._ ## Community discussion Top comments from developers on daily.dev. **@trevorsuna** · 0 upvotes > The third-party cloud detail is a reminder that responsibility does not transfer with hosting. Until the entry point and affected identities are known, the practical priorities are credential rotation, access-log preservation, and checking trust paths across providers. ## Similar posts on daily.dev - [Pharma giant Novo Nordisk discloses breach of clinical trials data](https://daily.dev/posts/pharma-giant-novo-nordisk-discloses-breach-of-clinical-trials-data-rsifeek9k) · BleepingComputer · 0 upvotes · 0 comments - [Thousands more learn their health info stolen from TriZetto](https://daily.dev/posts/thousands-more-learn-their-health-info-stolen-from-trizetto-dty784ghh) · The Register · 0 upvotes · 0 comments - [Security briefing: September 2026](https://daily.dev/posts/security-briefing-september-2026-effyny3go) · Sysdig Blog · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#healthcare](https://daily.dev/tags/healthcare), [#data-breach](https://daily.dev/tags/data-breach) [View this post on daily.dev](https://daily.dev/posts/amgen-says-cloud-data-breach-exposed-patient-health-proprietary-info-squzyz7bh) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Amgen says cloud data breach exposed patient health, proprietary info","url":"https://daily.dev/posts/amgen-says-cloud-data-breach-exposed-patient-health-proprietary-info-squzyz7bh","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/amgen-says-cloud-data-breach-exposed-patient-health-proprietary-info-squzyz7bh"},"datePublished":"2026-07-31T22:20:37.532Z","dateModified":"2026-09-14T06:15:33.130Z","description":"Pharmaceutical giant Amgen disclosed a data breach in which threat actors exfiltrated sensitive data — including patient protected health information and...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/483fc88078fdff56080c23428e23ecea?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/483fc88078fdff56080c23428e23ecea?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/amgen-says-cloud-data-breach-exposed-patient-health-proprietary-info-squzyz7bh","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"security,healthcare,data-breach","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"Amgen says cloud data breach exposed patient health, proprietary info"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/amgen-says-cloud-data-breach-exposed-patient-health-proprietary-info-squzyz7bh","comment":[{"@type":"Comment","text":"The third-party cloud detail is a reminder that responsibility does not transfer with hosting. Until the entry point and affected identities are known, the practical priorities are credential rotation, access-log preservation, and checking trust paths across providers.","datePublished":"2026-08-01T08:39:38.053Z","url":"https://daily.dev/posts/SQUzyZ7BH#c-3m3GUtKmt","author":{"@type":"Person","name":"Trevor Suna","url":"https://daily.dev/trevorsuna","image":"https://media.daily.dev/image/upload/s--dZ7gXxpp--/f_auto/v1784081551/avatars/avatar_EMoP47rpuw8DNjhp6R1b6?_a=BAMAMicg0"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/amgen-says-cloud-data-breach-exposed-patient-health-proprietary-info-squzyz7bh#faq","mainEntity":[{"@type":"Question","name":"What happened in the Amgen cloud data breach?","acceptedAnswer":{"@type":"Answer","text":"Threat actors stole corporate and patient data from multiple cloud environments operated by third-party service providers used by Amgen. The pharmaceutical company detected the unauthorized activity in July 2026, activated its cybersecurity response plan, and confirmed that proprietary data and patient protected health information were exfiltrated. Amgen is still investigating whether additional business, intellectual property, R&D, or patient data was also accessed. Security teams tracking healthcare breach disclosures like this can follow developments on daily.dev."}},{"@type":"Question","name":"Has Amgen said which cloud providers or attackers were involved in its data breach?","acceptedAnswer":{"@type":"Answer","text":"No, Amgen has not disclosed which third-party cloud providers were compromised, how the environments were breached, how many people were affected, or whether the attack is linked to a known threat actor. Reporters have asked whether the breach involved a vishing attack on an employee's single sign-on account and whether the extortion group ShinyHunters was involved, but Amgen had not responded at the time of disclosure. Anyone monitoring supply chain and SaaS breach attribution can track updates on daily.dev."}},{"@type":"Question","name":"Why did Amgen determine its 2026 data breach was a material event under SEC rules?","acceptedAnswer":{"@type":"Answer","text":"Amgen determined on July 29, 2026 that the breach was material after evaluating the volume of potentially impacted files and the likelihood they contained sensitive information, disclosing it via an SEC Form 8-K filing. Despite the materiality determination, Amgen stated it does not currently believe the incident is reasonably likely to materially affect its financial condition or operating results. Developers and compliance teams weighing breach materiality thresholds can follow such disclosures on daily.dev."}}]} ```