Amgen

Disclosed Jul 31, 202639,594 affectedConfirmed

Amgen says patient health data exfiltrated from third-party cloud systems

Amgen told the SEC that attackers exfiltrated proprietary data and patient protected health information from cloud environments operated by third-party service providers. It did not expect a material financial impact.

What is known

People affected	39,594 (as reported by the organization)
Disclosed	Jul 31, 2026
Discovered	Jul 2026
Happened	Jul 1, 2026
Attack	Vendor breach
Data exposed	HealthInternal documentsSocial Security numbersGovernment IDsInsurancePayment cardsFinancialDates of birthAddressesNames
Sector	Healthcare · US
Status	Confirmed

Sources

Official noticeoag.ca.gov

California Attorney General breach notice: Amgen

SEC filingsec.gov

Amgen Inc Form 8-K, Item 1.05 (2026-07-31)

Newsbleepingcomputer.com

Amgen says cloud data breach exposed patient health, proprietary info

Official noticeoag.my.site.com

Texas Attorney General data security breach report BR-0005264: Amgen

Official noticeago.vermont.gov

Vermont Attorney General breach report: Amgen

Official noticein.gov

Indiana Attorney General 2026 data breach report: Amgen

Notices filed

TotalJul 31

SEC 8-KCount not stated

TotalJul 31

ResearchCount not stated

Residents of CAAug 17

California AGCount not stated

Residents of VTAug 17

Vermont AG24 people

Residents of INAug 17

Indiana AG935 people

Residents of TXAug 18

Texas AG6,714 people

Other breaches at Amgen

Hacking breachHacking exposed names and health records. Reported to the California AG.1.6M affectedTechUSMay 30, 2024 Breach, details not statedBreach notice filed with the California AG, details not stated.TechUSJun 22, 2021 Breach, details not statedBreach notice filed with the California AG, details not stated.TechUSJun 26, 2018

History of this record

source2026-10-02

empty to https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/DB-October-Year-to-Date-Report-2026.pdfby dailySource

source2026-09-25

empty to https://ago.vermont.gov/categories/security-breach-noticesby backfillSource

data_types2026-09-25

["health","internal-docs"] to ["health","internal-docs","ssn","government-id","insurance","payment-card","financial","dob","addresses","names"]by backfillSource

records_basis2026-09-25

empty to organizationby backfillSource

records2026-09-25

empty to 39594by backfillSource

sector2026-09-25

tech to healthby seedSource

attack2026-09-25

unknown to third-partyby seedSource

data_types2026-09-25

[] to ["health","internal-docs"]by seedSource

discovered2026-09-25

empty to 2026-07by seedSource

summary2026-09-25

empty to Amgen told the SEC that attackers exfiltrated proprietary data and patient protected health information from cloud environments operated by third-party service providers. It did not expect a material financial impact.by seedSource

title2026-09-25

Material cybersecurity incident reported to the SEC (8-K Item 1.05) to Amgen says patient health data exfiltrated from third-party cloud systemsby seedSource

disclosed2026-09-25

2026-08-17 to 2026-07-31by backfillSource

title2026-09-25

empty to Material cybersecurity incident reported to the SEC (8-K Item 1.05)by backfillSource

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.

Everything about Amgen