Amgen Files Material SEC 8-K: Attackers Exfiltrate Patient PHI and Proprietary Drug R&D Data from Multiple Third-Party Cloud Environments

Amgen disclosed a material cybersecurity incident via SEC Form 8-K on July 31, confirming that threat actors exfiltrated patient protected health information (PHI), proprietary corporate data, and R&D information from cloud environments operated by unnamed third-party service providers — not Amgen's own internal infrastructure. The company identified the unauthorized activity in July 2026, determined materiality based on volume and sensitivity of affected records on July 29, and has not yet named the cloud providers, the initial access vector, the threat actor, or the number of affected individuals. The breach fits a documented 2026 pattern of pharmaceutical and life sciences attackers targeting third-party cloud tenants, consistent with campaigns attributed to ShinyHunters and other data-theft extortion groups active in the sector this year.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the high severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.