Amgen Sued Over Data Breach Affecting Patient Information
A class action alleges Amgen neglected to secure patient data after a 2023 breach via vendor Sirva.
Why it matters: This case highlights critical legal and compliance risks linked to cybersecurity and third-party vendor breaches in pharma.
- Data breach occurred between August 16 and October 17, 2023, involving Amgen’s vendor Sirva, Inc.
- Sirva notified Amgen about unauthorized access affecting personal information on April 10, 2024.
- Amgen informed impacted individuals and regulators following data privacy laws.
- Lawsuit filed August 7, 2024, in Pennsylvania alleges failure to safeguard patient data.
On August 7, 2024, a Pennsylvania resident filed a class action lawsuit against pharmaceutical company Amgen, claiming it failed to adequately protect patient data after a cyberattack compromised its third-party vendor’s systems. This lawsuit reported by Courthouse News centers on a data breach suffered by Sirva, Inc., a service provider for Amgen.
The breach took place between August 16 and October 17, 2023. During this period, hackers accessed Sirva’s systems and copied files containing personal information associated with individuals connected to Amgen, according to breach notifications published on ClassAction.org.
Sirva informed Amgen on April 10, 2024, about the unauthorized access and the potential impact on personal data, as detailed in official breach correspondence. Amgen then proceeded to notify affected individuals and regulatory authorities in compliance with data privacy laws.
The lawsuit alleges Amgen failed to exercise sufficient oversight and safeguard patient information despite known cybersecurity threats involving third-party vendors. For legal professionals, this case underscores the importance of rigorous vendor management and data security practices to meet regulatory obligations and protect sensitive data.
A class action lawsuit allows individuals impacted by the breach to combine their claims, streamlining legal processes and potentially increasing pressure on companies to fortify their defenses.
This litigation may also draw increased regulatory scrutiny on pharmaceutical companies’ cybersecurity measures, potentially influencing industry standards for managing risks related to third-party vendors.
By the numbers:
- August 16–October 17, 2023 — Duration of the data breach involving Amgen’s vendor Sirva
- April 10, 2024 — Date Sirva notified Amgen of breach and potential data impact
- August 7, 2024 — Filing date of the class action lawsuit in Pennsylvania
Yes, but: While the breach affected personal data, the exact scope and sensitivity of compromised information have not been fully disclosed, leaving some uncertainty about the severity of impact.
What's next: Legal proceedings on the class action lawsuit are expected to unfold in Pennsylvania courts, with potential implications for vendor cybersecurity liability in the pharmaceutical sector.