Loading story…
Amgen disclosed a material data breach involving cloud environments operated by third-party service providers, saying attackers gained unauthorized access and exfiltrated patient protected health information, proprietary company data, and other records. The company detected the activity in July 2026, activated its incident response plan, contained the intrusion, and brought in independent forensic experts to investigate. Amgen said it has not yet identified the affected cloud providers, the intrusion method, the number of impacted individuals, or any threat actor tied to the breach.
The company determined the incident was material on July 29 based on the volume of affected files and the possibility that highly sensitive information was included. Amgen is still assessing whether confidential business information, intellectual property, research and development data, or additional patient data were accessed, while also evaluating notification obligations tied to the theft of PHI. Reporting on the incident indicates the breach could trigger both HIPAA compliance requirements and SEC disclosure scrutiny, although Amgen said it does not currently expect a material impact on its financial condition or operations.
See attribution, scope, and your downstream exposure.
3 events from the most recent confirmed update back to the earliest known activity.
Amgen determined on July 29, 2026 that the incident was material after reviewing the volume of impacted files and the possibility that sensitive information was included. The company said attackers exfiltrated protected health information, proprietary data, and other records.
Amgen said it detected unauthorized activity in July 2026 affecting cloud environments operated by third-party service providers. After discovery, the company activated its cybersecurity response plan, contained the incident, and engaged independent forensic experts.
Amgen disclosed a cloud-related data breach involving third-party service provider environments that exposed patient health information and proprietary company data. The company said it was still assessing whether additional confidential business information, intellectual property, research and development data, or more patient data were also accessed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecysecurity.news
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Amgen disclosed a material cybersecurity incident after attackers gained unauthorized access to data stored in third-party cloud environments and exfiltrated sensitive information. The company said the stolen data includes patient protected health information, proprietary corporate information, and other files, with the potential scope also extending to confidential business information, intellectual property, and research and development data. Amgen said it detected the unauthorized activity in July 2026, activated its cybersecurity response plan, implemented containment measures, and brought in independent forensic experts to investigate. The company determined on July 29 that the breach was material because of the volume and sensitivity of the affected files, but it has not identified the cloud providers involved, the intrusion method, the number of impacted individuals, or any responsible threat actor, and said it has not found disruption to manufacturing, product availability, financial reporting systems, or patient services while it evaluates legal and regulatory notification obligations.
Aug 5, 2026
AdaptHealth disclosed a material cybersecurity incident after attackers used social engineering against a third-party contractor, compromised the contractor’s credentials, and accessed the company’s cloud-based business applications. The intrusion exposed internal patient management systems, document storage platforms, external electronic health record portals, and a stored password file tied to insurance billing, with patient personally identifiable information and protected health information believed to have been stolen. The company said the attacker contacted it on June 15 to disclose the theft, and it later determined the breach was material enough to report to the SEC. AdaptHealth said it disabled the contractor account, reset credentials, added access controls, engaged third-party cybersecurity experts, and notified law enforcement while the investigation continues. The company reported that operations and patient services were not disrupted, the total number of affected individuals is still unknown, and Social Security numbers, financial account information, and payment card data are not believed to have been stored in the compromised systems. Reporting also indicated the activity may be consistent with a data-theft-and-extortion attempt linked to **ShinyHunters**, which allegedly listed AdaptHealth on a leak site and threatened to publish the stolen data if no ransom is paid.
Jul 6, 2026
Aesto Health, a US healthcare data migration and archiving provider, disclosed that an unauthorized actor accessed a limited portion of its Amazon Web Services environment and may have acquired personal information and protected health information for **9,540,683 individuals**. The activity occurred between December 2 and December 18, 2025; the company detected unauthorized activity on December 18 and concluded following forensic investigation and document review on May 26, 2026, that data had been exfiltrated during that period. The breach affects data supplied by at least two dozen healthcare-provider clients across multiple US states, some of which have issued their own notifications to potentially affected patients. Aesto said it notified impacted provider customers and reported the incident to the US Department of Health and Human Services, but it has not identified the threat actor, entry method, affected AWS resource, or volume of stolen data. The company said it has no evidence so far of resulting identity theft or financial fraud.
Sep 4, 2026