Amgen announced on Aug. 3 that a cybersecurity breach has affected protected patient health information and other sensitive company data. The pharmaceutical company disclosed in a regulatory filing that unauthorized activity was detected in its cloud storage hosted by third-party service providers, leading to the exfiltration of proprietary data, patient protected health information, and other information from these repositories. An investigation into the incident is ongoing.
The company said it considers the cybersecurity event to be material due to the volume of files impacted and the potentially sensitive nature of the accessed information. However, Amgen reported that there has been no discernible impact on its ability to meet patient needs. The breach does not appear to have compromised financial reporting, manufacturing operations, or products, and Amgen does not expect its financial condition to be affected.
"Amgen takes its obligation to safeguard privacy and security of its patients’ data very seriously," the company said in a statement. It added that proper regulatory and legal notifications will be made as needed but did not provide avenues of recourse for patients potentially affected by the breach.
Amgen is scheduled to report second quarter earnings on Tuesday.
In recent months, Amgen has faced additional challenges beyond this cyberattack. In January, the Food and Drug Administration called for voluntary withdrawal of Tavneos, a rare disease drug acquired through Amgen's $3.7 billion purchase of ChemoCentryx in 2022. Amgen refused this request; tensions increased when regulators alleged manipulation of pivotal approval data in April. The company subsequently requested a hearing with regulators and submitted supporting evidence last month along with patient testimonials.
Earlier in July, Amgen recalled nearly one million bottles of Corlanor due to contamination concerns. Other major pharmaceutical companies have also experienced cyberattacks recently: Novo Nordisk reported a similar breach in June affecting clinical trial participant data but stated only deidentified information had been accessed.
