A cloud data breach at Amgen, one of the world's largest biotech companies, has exposed sensitive patient health information and proprietary business data. If a company with enterprise-level security resources can find itself in this position, smaller businesses — with fewer dedicated staff and tighter budgets — need to pay close attention to what went wrong and why it could happen to them too.
What Actually Happened in the Amgen Breach
Amgen disclosed that data stored in a cloud environment was accessed without authorisation, resulting in the exposure of patient health information alongside confidential business data. While full technical details remain limited, early indicators point to third-party involvement — meaning the breach likely originated not within Amgen's own walls, but through a vendor or partner with access to their cloud systems.
This pattern is increasingly common. Businesses share credentials, API keys, and system access with suppliers, software providers, and contractors every day. Each of those connections is a potential entry point. When one link in that chain is compromised, everything connected to it is at risk.
Why Third-Party Cloud Risk Is an SMB Problem Too
It's tempting to read a story like this and think it only applies to large corporations. In reality, the same vulnerabilities exist at every level. Small and medium businesses regularly use cloud tools — accounting platforms, CRMs, HR software, file-sharing services — and grant those platforms access to sensitive data. If any one of those providers is breached, your customer records, employee information, or financial data could end up exposed.
What makes this especially dangerous for SMBs is visibility. Large enterprises often have dedicated security teams running continuous monitoring. Most small businesses have no reliable way of knowing when their data — or credentials associated with their business — shows up somewhere it shouldn't. By the time they find out, the damage is already done.
This is exactly the kind of exposure that Breachrr is built to catch. We scan breach databases, infostealer logs, dark web markets, public code repositories, and domain infrastructure to surface signals that your business data has been compromised — often before you'd ever know otherwise.
The Hidden Danger: Credentials That Outlive Their Welcome
One of the quietest risks in any cloud breach is lingering credentials. When a third-party vendor is compromised, any login details, tokens, or API keys your team shared with that vendor may now be in the hands of someone who shouldn't have them. If those credentials haven't been rotated — or if employees have reused passwords across multiple services — attackers can pivot from one breach into your own systems.
Infostealer malware, which is bought and sold routinely on dark web markets, is particularly effective at harvesting exactly this kind of data. A single infected device at a vendor site can quietly collect usernames, passwords, session cookies, and stored credentials before anyone notices. That data then gets packaged and sold, and your business information is suddenly sitting in a database that anyone with the right contacts can buy access to.
The Amgen incident is a reminder that proprietary business data — not just personal health records — is a target. Competitive intelligence, internal pricing, client lists, and product roadmaps all have real value to bad actors.
What You Should Be Doing Right Now
You don't need an enterprise security budget to take meaningful action after a breach like this one. Start by auditing which third-party tools and vendors have access to your systems or data. Review what credentials have been shared and whether any of them are still active accounts that are no longer needed. Enforce unique, strong passwords and multi-factor authentication across your business tools.
Beyond that, you need visibility. Waiting for a breach notification to arrive — if one ever does — is not a strategy. Proactive monitoring is the only way to find out if your domain, email addresses, or employee credentials have appeared in a cloud data breach, an infostealer dump, or a dark web marketplace.
Breachrr exists to give SMBs that visibility without requiring a security team to operate it. If you haven't checked your exposure recently, now is a good time to start. Run a free audit at breachrr.com/audit and find out what's already out there with your name on it.
Want to see if your company is exposed?