Amgen announced on July 31 that a cyberattack led to the theft of company data and patient health information after attackers breached cloud storage systems operated by third‑party providers. In a regulatory filing, the company said it deemed the incident “material” on July 29 due to the number of files potentially affected and the possible sensitivity of the information they contain.
Detail of the incident
According to the regulatory filing, the compromise involved cloud storage systems managed by third‑party vendors. Amgen says both corporate data and patient health information were stolen, but it did not quantify the number of files impacted or provide specific examples of the types of data taken.
Measures taken by Amgen
Amgen reports that it activated its cyber incident response plan, implemented containment measures, and retained independent digital forensics experts to investigate. The company is continuing its inquiry to determine the scope of the breach and the potential consequences for affected individuals.
What the “material” designation means
Amgen’s July 29 decision to classify the incident as “material” was based on its internal assessment of the volume of files involved and the possibility those files include sensitive information. That designation indicates the company believes the incident could be significant to shareholders or other stakeholders, which is why it was disclosed via a regulatory filing.
Amgen says it remains focused on containing the breach and determining the incident’s full impact. To date, it has not provided an estimate of the number of records compromised or a timeline for notifying potentially affected individuals.
