Amgen amgen.com Amgen data breach 2026: what happened and what to do
In an SEC filing on July 31, 2026, Amgen said unauthorized activity in July 2026 led to data being taken from cloud environments run by outside providers, including patient health information. Amgen hasn't said how many people were affected.
View all 13,115 breaches- Breach date
- Jul 2026
- Made public
- 31 Jul 2026
- Last updated
What happened
Amgen, the US biotechnology company, said in a Form 8-K filed with the Securities and Exchange Commission on July 31, 2026 that it had found unauthorized activity in July 2026. According to the filing, some of its data, including proprietary data, patient protected health information and other information, was taken from cloud environments run by outside providers. Amgen has not named those providers.
The company has not said how many people were affected, and it had not yet sent notices to individuals when the filing and early coverage appeared. It said it continues to evaluate its legal and regulatory notification obligations and will notify people, including impacted patients, as required. Amgen has not attributed the attack to any group. BleepingComputer asked whether a voice phishing attack on an employee's single sign-on account was involved, and whether ShinyHunters was behind it, but those points are unconfirmed.
The incident is listed on a state attorney general breach notification site, dated August 17, 2026. Several law firms have announced investigations. A law firm announcement is a solicitation for clients, not a finding about the breach.
What was exposed
The filing says patient protected health information was among the data, but it doesn't say which patients, how many, or which details. Protected health information is the legal term for health data tied to a person, such as a diagnosis, a prescription or treatment details. Until Amgen sends notices, nobody outside the company knows exactly what each person's record contained, so this page doesn't list data types.
What it means for you
If you take an Amgen medicine or took part in one of its programs, wait for a letter, and read it. Health data is the part criminals value for insurance fraud and for targeted scams. A caller who knows which medicine you take sounds like a pharmacist or a program nurse, and may ask you to pay for something or confirm your insurance details.
Be sure of who you are talking to before you share anything. Call the number on your insurance card or pharmacy label, not a number a caller gives you.
What Amgen has said
Amgen said it will make the notifications that law requires, including to impacted patients. There was no announced credit monitoring offer.
Check your own exposure
A free Serus scan checks whether your email and phone number appear in breaches, and Serus keeps watching and alerts you to new ones. Serus can't remove data from a breach.
Why the details are thin
The 8-K is a short disclosure aimed at investors, written when the company's investigation was still open. Companies often learn what was taken and whose it was only weeks or months later, and individual letters follow that work. Expect the picture on this page to change. If you want the current facts, Amgen's investor relations page carries its filings.
What to do if you were in it
- 1
Watch for a notice from Amgen
Amgen says it will notify affected people, including patients. Read the letter when it arrives and follow its steps. Don't act on emails or texts that claim to be the notice.
- 2
Be careful with calls about your medication
Someone who knows which medicine you take can sound like a pharmacist or nurse. Don't share payment or insurance details. Hang up and call the number on your insurance card or pharmacy label.
- 3
Review your insurance statements
Check explanations of benefits for services or prescriptions you didn't receive, and report anything odd to your insurer.
- 4
Freeze your credit if you get a notice mentioning ID data
Freezing your credit at Equifax, Experian and TransUnion is free and blocks new accounts in your name.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see where your email and phone number have been exposed, and get an alert when they appear in a new breach.
Frequently asked
Was I affected by the Amgen data breach?
Amgen hasn't said who was affected. It says it will notify affected people, including patients, as required. Watch for a letter and be careful with unsolicited messages about the breach.
What data was exposed?
Amgen's SEC filing says proprietary data and patient protected health information, among other information, was taken. It doesn't say which details.
How many people were affected?
Amgen hasn't said.
Who was behind the Amgen breach?
Amgen hasn't attributed it to any group. Reports that a particular extortion group was involved are unconfirmed.
Sources
- bleepingcomputer.com/news/security/amgen-says-cloud-data-breach-exposed-patient-health-proprietary-info/amp/
- teiss.co.uk/news/amgen-discloses-data-breach-involving-patient-health-information-stored-in-third-party-cloud-systems-17920
- investors.amgen.com/static-files/bb4ed8dc-c464-434f-84db-7e52910b7fdf
Something wrong or out of date? Tell us and we'll re-check it.
