Amgen confirms patient health data stolen in third-party cloud breach

Biotechnology giant Amgen has launched a forensic investigation after attackers removed sensitive patient and company information from cloud systems operated by external providers.

Amgen has confirmed that patient health information and proprietary corporate data were stolen during a cybersecurity incident involving cloud environments managed by third-party service providers.

The US drugmaker classified the breach as a material cybersecurity incident on July 29 after assessing the number of files believed to have been affected and the potential sensitivity of the information contained within them. The incident was formally disclosed in a filing with the US Securities and Exchange Commission on July 31.

Amgen said it identified unauthorised activity affecting data stored in third-party cloud environments during July. After detecting the activity, the company activated its cybersecurity response plan, introduced containment measures and engaged independent forensic specialists to investigate the intrusion.

The investigation has already established that information was removed from the affected systems. According to the company, the stolen material includes proprietary data, patient protected health information and other records.

However, the full extent of the breach remains unclear. Amgen has not disclosed how many patients or files may be affected, which cloud providers were involved, when the attackers first gained access or who may have been responsible.

The company is continuing to determine whether confidential business information, intellectual property, research and development material, additional patient records or other sensitive information may have been accessed, acquired or stolen.

Despite the data loss, Amgen said it had not identified any effect on its medicines, manufacturing operations, financial reporting systems or ability to meet the needs of patients. The company also said it did not currently believe the breach was likely to have a material effect on its financial condition or operating results.

That assessment could change as investigators establish how much information was taken and whether it has been distributed, sold or otherwise misused.

Amgen is also evaluating its legal and regulatory notification obligations. It said affected parties, including patients, would be contacted where required once the investigation provides enough information to identify those involved.

“Amgen takes its obligation to safeguard privacy and security of its patients’ data very seriously,” the company said in its regulatory filing.

The breach places Amgen among a growing number of major healthcare and pharmaceutical businesses confronting cybersecurity incidents. Abbott Laboratories, Clover Health, Stryker, Medtronic, Novo Nordisk and West Pharmaceutical Services have also recently been affected by cyberattacks or security disruptions.

Healthcare organisations remain attractive targets because their systems can contain extensive collections of medical, identity, financial and commercially sensitive information. Amgen’s disclosure also highlights the risks created when critical data is held in cloud environments outside a company’s directly managed infrastructure.

The incident comes at an already difficult time for Amgen, which is facing separate regulatory scrutiny over Tavneos, a treatment for rare autoimmune diseases affecting blood vessels.

The New England Journal of Medicine retracted a report on the pivotal clinical trial supporting Tavneos on June 29. The US Food and Drug Administration has proposed withdrawing the medicine’s approval, arguing that it has not been shown to be effective for its authorised use and that the original application contained inaccurate material statements.

The European Medicines Agency has also recommended that Tavneos lose its marketing authorisation in the European Union. The regulator said data from the principal clinical trial could no longer be relied upon to demonstrate the medicine’s effectiveness and that its benefits were no longer proven to outweigh its risks.

Amgen has maintained that Tavneos remains an important treatment option and has defended the medicine’s benefit and risk profile.

The company has not provided a timetable for completing its cybersecurity investigation. It said it would amend its SEC disclosure as further material information becomes available, while continuing to assess the breach’s potential effects and the notifications required for affected patients and other parties.