Loading story…
Amgen disclosed a material cybersecurity incident after attackers gained unauthorized access to data stored in third-party cloud environments and exfiltrated sensitive information. The company said the stolen data includes patient protected health information, proprietary corporate information, and other files, with the potential scope also extending to confidential business information, intellectual property, and research and development data.
Amgen said it detected the unauthorized activity in July 2026, activated its cybersecurity response plan, implemented containment measures, and brought in independent forensic experts to investigate. The company determined on July 29 that the breach was material because of the volume and sensitivity of the affected files, but it has not identified the cloud providers involved, the intrusion method, the number of impacted individuals, or any responsible threat actor, and said it has not found disruption to manufacturing, product availability, financial reporting systems, or patient services while it evaluates legal and regulatory notification obligations.
See attribution, scope, and your downstream exposure.
5 events from the most recent confirmed update back to the earliest known activity.
On July 31, 2026, Amgen said the cloud-related cybersecurity incident appeared limited to unauthorized data access and had not affected manufacturing, patient services, product availability, supply chain activities, clinical operations, financial reporting systems, or medicine delivery. The company said it was still assessing the scope of exposed information.
On July 29, 2026, Amgen determined that the incident was a material cybersecurity incident after evaluating the volume of potentially impacted files and the sensitivity of the information involved. The company said stolen data included proprietary information, patient protected health information, and other data.
After discovering the intrusion, Amgen activated its cybersecurity response procedures, implemented containment measures, and retained independent forensic experts to investigate. The company said the investigation remains ongoing.
Amgen identified unauthorized activity involving data stored in cloud environments operated by third-party service providers in July 2026. The company later found that attackers had gained unauthorized access and exfiltrated data from those environments.
Amgen disclosed the incident in a Form 8-K filing with the SEC, stating that attackers exfiltrated corporate and patient data from multiple third-party cloud environments. The company said it was evaluating legal and regulatory notification obligations and would notify impacted patients where required.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
10 references tracked. Mallory keeps watching after this page renders.
thecyberthrone.in
Open sourcescworld.com
Open sourcehipaajournal.com
Open sourcetherecord.media
Open sourcecysecurity.news
Open sourcethecybersecguru.com
Open sourcebleepingcomputer.com
Open sourcesec.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Amgen disclosed a material data breach involving cloud environments operated by third-party service providers, saying attackers gained unauthorized access and exfiltrated patient protected health information, proprietary company data, and other records. The company detected the activity in July 2026, activated its incident response plan, contained the intrusion, and brought in independent forensic experts to investigate. Amgen said it has not yet identified the affected cloud providers, the intrusion method, the number of impacted individuals, or any threat actor tied to the breach. The company determined the incident was material on July 29 based on the volume of affected files and the possibility that highly sensitive information was included. Amgen is still assessing whether confidential business information, intellectual property, research and development data, or additional patient data were accessed, while also evaluating notification obligations tied to the theft of PHI. Reporting on the incident indicates the breach could trigger both **HIPAA** compliance requirements and **SEC** disclosure scrutiny, although Amgen said it does not currently expect a material impact on its financial condition or operations.
Aug 18, 2026
Astrana Health disclosed that attackers impersonated company personnel and spoofed its main corporate telephone number in a social-engineering campaign that gained access to company servers. The California-based healthcare-management company confirmed that private and confidential information was exfiltrated, while it investigates whether patient, employee, provider, business, financial, intellectual-property, or other sensitive data was affected. Astrana characterized the incident as material because of the potentially sensitive information involved, though it said it does not expect a material impact on financial condition or operations. The company rotated credentials, restricted remote-access tools, rebuilt and restored affected systems from clean backups, and enhanced monitoring, logging, and detection; it also notified law enforcement, regulators, customers, and partners. No threat actor had claimed responsibility, and Astrana has not confirmed ransomware involvement.
Sep 26, 2026
AdaptHealth disclosed a material cybersecurity incident after attackers used social engineering against a third-party contractor, compromised the contractor’s credentials, and accessed the company’s cloud-based business applications. The intrusion exposed internal patient management systems, document storage platforms, external electronic health record portals, and a stored password file tied to insurance billing, with patient personally identifiable information and protected health information believed to have been stolen. The company said the attacker contacted it on June 15 to disclose the theft, and it later determined the breach was material enough to report to the SEC. AdaptHealth said it disabled the contractor account, reset credentials, added access controls, engaged third-party cybersecurity experts, and notified law enforcement while the investigation continues. The company reported that operations and patient services were not disrupted, the total number of affected individuals is still unknown, and Social Security numbers, financial account information, and payment card data are not believed to have been stored in the compromised systems. Reporting also indicated the activity may be consistent with a data-theft-and-extortion attempt linked to **ShinyHunters**, which allegedly listed AdaptHealth on a leak site and threatened to publish the stolen data if no ransom is paid.
Jul 6, 2026