Almeida Law Group is investigating a data breach at Amgen Inc. The breach occurred on July 1st, 2026. If you were affected, contact Almeida Law Group.
About Amgen Inc.
Amgen Inc. is an American multinational biopharmaceutical company headquartered in Thousand Oaks, California. Founded in 1980, it discovers, develops, manufactures, and delivers medicines for serious illnesses including cancer, cardiovascular disease, inflammation, and rare diseases. The company is publicly traded on the NASDAQ and is a component of the Dow Jones Industrial Average and S&P 500, reporting approximately $36.8 billion in revenue in 2025 and employing roughly 31,500 people worldwide. Because Amgen works directly with patients, it holds sensitive personal, medical, and health insurance information, making it a high-value target for cybercriminals.
What Happened?
Amgen Inc. was listed in a California Attorney General sample breach notice filed on August 17th, 2026. According to that notice and Amgen’s own disclosures, on or about July 2nd, 2026, Amgen detected unauthorized third-party access to data stored in cloud environments hosted by third-party cloud service providers. On July 18th, 2026, Amgen confirmed that the unauthorized party had obtained and acquired files containing patient personal and health information. The total number of individuals affected nationwide has not been publicly disclosed. Amgen determined the incident was material on July 29th, 2026, and filed a Form 8-K with the SEC on July 31st, 2026. The compromised data included names, email addresses, postal addresses, dates of birth, government identification numbers, medical information, and health insurance information. For some individuals, Social Security numbers and personal financial information, such as bank account numbers, were also involved. Amgen’s SEC filing also referenced proprietary company data being exfiltrated.
The specific cloud service providers involved have not been publicly identified, and the identity of the threat actors remains unknown. No ransomware group has claimed responsibility as of available reporting. A class action lawsuit (Case 2:26-cv-08688) was filed on August 6th, 2026 in federal court by lead plaintiff Heidi Humphreys, alleging that Amgen’s deficient cybersecurity practices led to the breach. Additional class action investigations have been announced by Edelson Lechtzin LLP, Schubert Jonckheer & Kolbe LLP, and attorneys working with ClassAction.org. This incident also follows a documented pattern of third-party data exposure at Amgen, most notably an April 2024 disclosure in which a former vendor notified the company that individually identifiable health information of over 1.7 million Amgen patients had been involved in a cybersecurity incident.
Key Facts at a Glance
- Company or Organization: Amgen Inc.
- Industry: Biotechnology / Biopharmaceuticals
- Location: Thousand Oaks, California
- Incident type: Unauthorized third-party access to data stored in cloud environments hosted by third-party cloud service providers
- Date of breach: July 1st, 2026
- Date breach discovered: July 2nd, 2026
- Date of consumer notification: August 17th, 2026
- Identity theft protection offered: 24 months of identity monitoring through Kroll (Credit Monitoring, Fraud Consultation, and Identity Theft Restoration)
- Prior breach: Yes — multiple prior third-party vendor incidents, including an April 2024 disclosure involving over 1.7 million patient records
- Litigation status: Class action filed August 6th, 2026 (Case 2:26-cv-08688, Humphreys v. Amgen); additional investigations by Edelson Lechtzin LLP, Schubert Jonckheer & Kolbe LLP, and ClassAction.org
- Source: California Attorney General sample breach notice; BleepingComputer; HIPAA Journal; Courthouse News Service
What Should You Do?
If you received a notice from Amgen, enroll in the 24 months of free identity monitoring through Kroll at enroll.krollmonitoring.com before your activation deadline. Whether or not you enroll, consider placing a fraud alert or credit freeze with the three major credit bureaus — Equifax, Experian, and TransUnion — to help prevent new accounts from being opened in your name. Review your bank and financial account statements closely for unauthorized transactions, and obtain free copies of your credit reports at AnnualCreditReport.com to check for suspicious activity. Because health and medical information was involved in this breach, also review any Explanation of Benefits statements from your health insurer and request copies of your medical records to check for errors or services you did not receive. If you believe your information has already been misused, report it at IdentityTheft.gov and contact your local law enforcement.
Your Legal Rights
If your personal or health information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
