Search every filing
2,477,667 paragraphs from 10-Ks, 10-Qs and 8-Ks with press releases.
Matching paragraphs
As leaders of the Technology and CDT functions within ATMOS, respectively, the Company’s CIO and CISO are informed about and monitor significant cybersecurity threats and incidents through the Company’s internal cybersecurity reporting structure. Our CDT team is responsible for monitoring and detecting cybersecurity threats and incidents. Our CDT team, overseen by our CISO, is also responsible for the mitigation and remediation of cybersecurity incidents. When members of the CDT team detect a cybersecurity threat or incident or are made aware of a cybersecurity incident encountered by a third-party service provider, the discovery is communicated to the Incident Response team, which includes our CISO and other senior members of the CDT function. The Incident Response team evaluates the severity of the cybersecurity threat or incident and shares its findings with our CISO.
Read in the filing ↗ Also in 10-K of Feb 13, 2026
Our CDT function has processes to oversee and identify the risks of cybersecurity threats associated with third-party service providers and monitors and works to mitigate the impact of cybersecurity incidents encountered by our third-party service providers. Upon becoming aware of cybersecurity incidents encountered by our third-party service providers, the CDT function’s Incident Response and Cyber Threat Intelligence teams are deployed to evaluate and mitigate the impact of such incidents on our business.
Read in the filing ↗ Also in 10-K of Feb 13, 2026
System vulnerabilities and/or cybersecurity breaches experienced by our third-party service providers have constituted a substantial share of the information security risks that have affected us. We continue to experience cybersecurity incidents involving third-party service providers, including incidents in which unauthorized third parties accessed or exfiltrated certain information, including non-significant Amgen data and personally identifiable patient information …
Read in the filing ↗ Also in 10-Q of Aug 5, 2026, 10-K of Feb 13, 2026
Despite our layered controls and cybersecurity efforts, the Company and its third-party vendors have experienced cyberattacks and information security vulnerabilities, and while such incidents have not had a material adverse effect on the Company, there can be no assurance that future cybersecurity attacks or incidents would not result in a material adverse effect
Read in the filing ↗ Also in 10-K of Feb 14, 2025
Our CISO and/or his senior team leaders, in addition to our CIO and CTO, also provide regular reports to executives leading our Finance, Compliance, Law and Human Resources functions on potentially significant cybersecurity incidents and the progress made towards mitigation and remediation of those incidents. These leaders oversee reporting to our CRCC and Audit Committee, and reporting of such cybersecurity incidents is included in the course of regular meetings of such committees. Additionally, in appropriate circumstances, reporting of potentially significant cybersecurity incidents is made directly to the leaders of our CRCC and Audit Committee or directly to the Board of Directors outside of their regular meeting schedule. Further, in support of our internal controls, our CISO also reviews cybersecurity matters and trends with our Accounting and Law functions at least on a quarterly basis.
Read in the filing ↗ Also in 10-K of Feb 13, 2026
Amgen has a multi-layered and iterative approach towards assessing, identifying, managing and mitigating risks from cybersecurity threats. The Amgen Technology & Medical Organizations (ATMOS) function is designed to support our productivity, innovation and outreach globally through the quality delivery of information systems, solutions and services for our business and operations. The ATMOS function has a Cybersecurity & Digital Trust (CDT) team that assesses and reduces cybersecurity exposure, including by providing employees with training and resources to identify potential cybersecurity threats and implementing information technology security practices. The CDT team also monitors for cybersecurity threat activity and seeks to mitigate the impact from cybersecurity incidents by deploying information security engineers, system architects, analysts and cybersecurity specialists to provide monitoring, reporting and management of cybersecurity incidents.
Read in the filing ↗ Also in 10-K of Feb 13, 2026
have made required regulatory notifications in connection with certain such incidents. In November 2025, a third-party service provider had a cybersecurity incident in which Amgen-related information was accessed and disclosed by a threat actor that, upon review, did not involve information material to the Company. Although these supplier data breaches have not resulted in material adverse effects on our business, there can be no assurance that a similar future cybersecurity incident would not result in a material adverse effect on our business or results of operations. Further, the timeliness of our awareness of a cybersecurity incident affects our ability to respond to and work to mitigate the severity of such events. For example, we have previously experienced incidents in which third-party vendors initially reported that cyberattacks did not involve our data but later determined that attackers had accessed limited, non-significant Amgen information. Although such incidents have not resulted in significant adverse effects on our business, future incidents in which we do not receive timely or complete information regarding the nature or scope of a cybersecurity event could impair our response and could have a material adverse effect on our business.
Read in the filing ↗
In addition to leveraging the Company’s own information technology resources, our Incident Response and Cyber Threat Intelligence teams engage, as needed, third-party cybersecurity risk assessors and consultants to assist in recognizing threats, identifying security vulnerabilities and evaluating the impact of cybersecurity attacks and incidents when they occur. On a biennial basis, our ATMOS also engages external third-party experts to assess the Company’s cybersecurity control maturity across the organization and develops plans to address such experts’ recommendations.
Read in the filing ↗ Also in 10-K of Feb 13, 2026
similar cybersecurity breach in which an attacker exfiltrated certain data (including non-significant Amgen data) from the service provider’s systems. Additionally, in April 2024, one of our former vendors notified us that its subsidiary that had provided us with certain patient support services until mid-2022, experienced a cybersecurity incident that it discovered in February 2024 and that data …
Read in the filing ↗
Our management team, including our CIO and CISO, supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which may include briefings from internal information security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information systems environment.
Read in the filing ↗ Also in 10-K of Feb 13, 2026
Our Board of Directors oversees an enterprise-wide approach to risk management, including risks related to information systems and cybersecurity, and each Board committee has primary risk oversight responsibilities aligned with its areas of focus. At each regular meeting of the Board, the Board receives and considers reports from each of its committees, and such reports provide additional detail on significant risk management issues as appropriate, including cybersecurity. The CRCC is the committee that has primary oversight responsibility for the Company’s information systems and management of cybersecurity and receives reports from our Senior Vice President and Chief Information Officer (CIO) and Chief Information Security Officer (CISO) that includes reviews of our information systems strategy, technology investments, cybersecurity risks and incidents, and third-party risk management, as well as an annual evaluation of the Company’s cybersecurity status. The Board’s Audit Committee has oversight responsibility of our internal controls, assurances and financial risks. The Audit Committee is provided with copies of materials presented to our CRCC by our CIO and CISO and receives reports from our CIO regarding topics including integration or implementation of new financial systems and key controls and governance designed to address cybersecurity risks associated with the use of such new financial systems.
Read in the filing ↗ Also in 10-K of Feb 13, 2026
… We are continuing to operationally integrate and transition the legacy Horizon systems into our own, with the integrated systems becoming subject to Amgen’s cybersecurity risk management structure and strategy. While we are integrating these systems, our CISO and CDT function are engaging in cybersecurity risk management activities, and any cybersecurity incidents detected on the legacy Horizon information systems are …
Read in the filing ↗
on our business strategy, results of operations or financial condition. For examples of such matters and a discussion of the risks that we face, see Item 1A. Risk Factors - A breakdown of our information technology systems, cyberattack or information security breach could significantly compromise the confidentiality, integrity and availability of our information technology systems, network-connected control systems and/or our data, interrupt the operation of our business and/or affect our reputation. However, we have not identified risk from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition.
Read in the filing ↗
… For example, as a result of our cybersecurity monitoring of the Horizon legacy information systems, we detected phishing activity in the accounts of two Horizon executives. These accounts were de-activated, the incidents were investigated and the determination was made separately by both our internal cybersecurity team and our external digital forensics and incident response supplier that no confidential information …
Read in the filing ↗
… For example, as a result of our cybersecurity monitoring of the Horizon legacy information systems, we detected phishing activity in the accounts of two Horizon executives. These accounts were de-activated, the incidents were investigated and the determination was made separately by both our internal cybersecurity team and our external digital forensics and incident response supplier that no confidential information …
Read in the filing ↗
… For example, as a result of our cybersecurity monitoring of the Horizon legacy information systems, we detected phishing activity in the accounts of two Horizon executives. These accounts were de-activated, the incidents were investigated and the determination was made separately by both our internal cybersecurity team and our external digital forensics and incident response supplier that no confidential information …
Read in the filing ↗ Also in 10-Q of Aug 5, 2026
Our systems also contain and use a high volume of sensitive data, including intellectual property, trade secrets and other proprietary business information, financial information, regulatory information, strategic plans, sales trends and forecasts, litigation materials and/or personal identifiable information belonging to us, our staff, our patients, customers and/or other parties. In some cases, we use third-party service providers to collect, process, store, manage or transmit such data, which has increased our risk. As our use of cloud-hosted environments and services has increased, we and others have experienced incidents in which threat actors accessed, copied or exfiltrated data stored in such environments by compromising credentials, access keys, tokens, accounts, configurations or permissions, including cases that did not involve a prior compromise of the corporate network or other on-premises systems, such as the cybersecurity incident we disclosed under Item 1.05 of our Current Report on Form 8-K filed on July 31, 2026.
Read in the filing ↗
… Certain AI-enabled tools, including AI-driven cybersecurity tools, are designed to rapidly identify vulnerabilities, misconfigurations and control gaps, increasing the volume and speed at which potential exposures are identified, and are likely to accelerate malicious activities by threat actors and increase the likelihood and/or severity of cyber incidents. If we do not effectively assess, implement, govern and update …
Read in the filing ↗ Also in 10-Q of Aug 5, 2026
… For example, we have experienced cybersecurity incidents at third-party vendors that provide testing, analytical, information technology and clinical data services, which required us to temporarily disconnect our systems from those vendors. Although these incidents did not result in breaches of our systems or significantly affect product availability, a prolonged or more widespread service outage affecting these or other vendors …
Read in the filing ↗ Also in 10-K of Feb 14, 2025
… In late 2020, SolarWinds Corporation, a leading provider of software for monitoring and managing information technology infrastructure, disclosed that it had suffered a cybersecurity incident whereby attackers had inserted malicious code into legitimate software updates for its products that were installed by myriad private and government customers, enabling the attackers to access a backdoor to such systems. We also rely …
Read in the filing ↗ Also in 10-Q of May 1, 2026, 10-Q of Aug 5, 2026, 10-K of Feb 14, 2025
… For example, we have experienced cybersecurity incidents at third-party vendors that provide testing, analytical, information technology and clinical data services, which required us to temporarily disconnect our systems from those vendors. Although these incidents did not result in breaches of our systems or significantly affect product availability, a prolonged or more widespread service outage affecting these or other vendors …
Read in the filing ↗ Also in 10-Q of May 1, 2026