SEC Form 8-K Item 1.05 (material cybersecurity incidents) Primary notice
Disclosed in a 8-K filed July 31, 2026, as listed by the SEC Form 8-K Item 1.05 (material cybersecurity incidents).
- Organization as reported
- AMGEN INC, CA
- Category as reported
Item 1.05 Material Cybersecurity Incidents
- Notice date as reported
- July 29, 2026
- Filing date
- July 31, 2026
- Observed by BreachRecords
- 2026-10-18 20:35 UTC (revision 8104, doc:amgn-20260729.htm)
- Archived copy
- Held in the private archive (provenance)
Material Cybersecurity Incidents. In July 2026, Amgen Inc. (the "Company") identified unauthorized activity involving data stored in cloud environments hosted by third-party cloud service providers. Upon detecting the activity, the Company activated its cybersecurity response plan, implemented containment measures, and engaged independent cybersecurity forensic experts. The Company has since learned that some of its data, including proprietary data, patient protected health information, and other information, has been exfiltrated from these cloud environments. To date, the Company has not identified any impact to its products, manufacturing operations, or financial reporting systems, or to the Company's ability to meet patient needs. The investigation remains ongoing. The Company continues to assess whether, and/or the extent to which, patient, confidential business information, intellectual property, research and development, or other information may have been accessed, acquired, or exfiltrated and to evaluate the potential impact of the incident on the Company. On July 29, 2026, in connection with our evaluation of the volume of the files that appear to have been impacted and the potential that the types of information in such files could be sensitive, the Company determined that this incident is material. The Company believes, as of the date of this Current Report on Form 8-K, that the incident is not reasonably likely to have a material impact on the Company's financial condition or results of operations. The Company takes its obligation to safeguard privacy and security of its patients’ data very seriously. The Company continues to evaluate applicable regulatory and legal notification requirements and will make all required notifications based on its findings, including to impacted patients. To the extent any information required by