Amgen (0R0T) Risk Analysis

To achieve our business objectives, we rely on sophisticated information technology systems, including hardware, software, technology infrastructure, online sites and networks for both internal and external operations, mobile applications, cloud services, artificial intelligence (AI)-enabled tools and systems, and network-connected control systems, some of which are managed, hosted, provided or serviced by third parties. Internal or external events that compromise the confidentiality, integrity and availability of our systems and data may significantly interrupt the operation of our business, result in significant costs and/or adversely affect our reputation. Our information technology systems, including AI-enabled tools and systems are highly integrated into our business, including our R&D efforts, our clinical and commercial manufacturing processes and our product sales and distribution processes. Further, as the majority of our employees work remotely for some portion of their jobs in our hybrid work environment, our reliance on our and third-party information technology systems has increased substantially and is expected to continue to increase. Remote and hybrid working arrangements, including those of many third-party providers, can increase cybersecurity risks due to the challenges associated with managing remote computing assets and security vulnerabilities that are present in many non-corporate and home networks. The complexity and interconnected nature of software, hardware and our systems make them vulnerable to breakdown or other service interruptions, and to software errors or defects, misconfiguration and other security vulnerabilities. For example, in July 2024, businesses worldwide were affected by an information technology outage due to a faulty software update issued by a cybersecurity firm. Although our systems and operations were temporarily affected by the outage, the impact of this firm's faulty update on the Company was immaterial to our business operations. However, there can be no assurance that a future similar incident would not result in a material adverse effect on our business or results of operations. Upgrades or changes to our systems or the software that we use have resulted and we expect, in the future, will result in the introduction of new cybersecurity vulnerabilities and risks. In the past, we have identified security vulnerabilities introduced into our information systems arising from flaws in third-party software that we had purchased and installed, which required us to apply emergency patches to certain systems. While we did not experience any significant adverse effects as a result of these vulnerabilities, there can be no assurance that we will timely identify and address future vulnerabilities. Our systems are also subject to frequent perimeter network reconnaissance and scanning, phishing and other cyberattacks. For example, as a result of our cybersecurity monitoring of the Horizon legacy information systems, we detected phishing activity in the accounts of two Horizon executives. These accounts were de-activated, the incidents were investigated and the determination was made separately by both our internal cybersecurity team and our external digital forensics and incident response supplier that no confidential information had been exfiltrated, and the incidents are now closed. As the cyber-threat landscape evolves, these attacks are growing in frequency, sophistication, and intensity, and are becoming increasingly difficult to detect and increasingly sophisticated in using techniques and tools, including AI, that circumvent security controls, evade detection and remove forensic evidence. Such attacks include the use of harmful and virulent malware, including ransomware or other denials of service, which can be deployed through various means, including the software supply chain, e-mail, malicious websites and/or the use of social engineering/phishing, and/or AI to orchestrate and automate sophisticated cyberattacks, including the documented instance in which an AI agent was used to conduct a large-scale intrusion campaign, potentially lowering the barriers to high-speed, high-volume attacks. We have also experienced denial of service attacks against our network, and, although such attacks did not succeed, there can be no assurance that our efforts to guard against the wide and growing variety of potential attack techniques will be successful in the future. Attacks such as those experienced by government entities (including those that approve and/or regulate our products, such as the EMA) and other multi-national companies, including some of our peers, could leave us unable to utilize key business systems or access or protect important data, and could have a material adverse effect on our ability to operate our business, including developing, gaining regulatory approval for, manufacturing, selling and/or distributing our products. For example, in 2017, a pharmaceutical company experienced a cyberattack involving virulent malware that significantly disrupted its operations, including its research and sales operations and the production of some of its medicines and vaccines. As a result of the cyberattack, its orders and sales for certain products were negatively affected. In late 2020, SolarWinds Corporation, a leading provider of software for monitoring and managing information technology infrastructure, disclosed that it had suffered a cybersecurity incident whereby attackers had inserted malicious code into legitimate software updates for its products that were installed by myriad private and government customers, enabling the attackers to access a backdoor to such systems. We also rely on third-party providers for certain identity, authentication and access management services. In the past, a security incident affecting such a third-party provider exposed several hundred corporate customers to potential unauthorized access to systems and data. Although that breach did not have a significant effect on our business, there can be no assurance that a similar future breach would not result in a material adverse effect on our business or results of operations. Our systems also contain and use a high volume of sensitive data, including intellectual property, trade secrets and other proprietary business information, financial information, regulatory information, strategic plans, sales trends and forecasts, litigation materials and/or personal identifiable information belonging to us, our staff, our patients, customers and/or other parties. In some cases, we use third-party service providers to collect, process, store, manage or transmit such data, which has increased our risk. Intentional or inadvertent data privacy or security breaches (including cyberattacks) resulting from attacks or lapses by employees, service providers (including providers of information technology-specific services), business partners, nation states (including groups associated with or supported by foreign intelligence agencies), organized crime organizations, "hacktivists" or others, create risks that our sensitive data may be exposed to unauthorized persons, our competitors or the public. Geopolitical tensions and the increasing targeting of critical infrastructure and global supply chains by nation-state and affiliated actors may heighten the risk of widespread or coordinated cyberattacks, affecting not only our systems but also those of key partners, vendors or industry platforms on which we rely. Malicious actors, including those working under state-sponsored campaigns, have sought employment, often in remote information technology roles, as a means to gain inside access at targeted companies. In two separate incidents, the most recent of which occurred in 2025, individuals used fraudulent identification in connection with their hiring by the Company. While these individuals were detected and terminated before any data was extracted or malware installed, there can be no assurance that future attempts by similar actors will be unsuccessful. System vulnerabilities and/or cybersecurity breaches experienced by our third-party service providers have constituted a substantial share of the information security risks that have affected us. We continue to experience cybersecurity incidents involving third-party service providers, including incidents in which unauthorized third parties accessed or exfiltrated certain information, including non-significant Amgen data and personally identifiable patient information, and we have made required regulatory notifications in connection with certain such incidents. For example, in November 2025, a third-party service provider had a cybersecurity incident in which Amgen-related information was accessed and disclosed by a threat actor that, upon review, did not involve information material to the Company. Although these supplier data breaches have not resulted in material adverse effects on our business, there can be no assurance that a similar future cybersecurity incident would not result in a material adverse effect on our business or results of operations. Further, the timeliness of our awareness of a cybersecurity incident affects our ability to respond to and work to mitigate the severity of such events. For example, we have previously experienced incidents in which third-party vendors initially reported that cyberattacks did not involve our data but later determined that attackers had accessed limited, non-significant Amgen information. Although such incidents have not resulted in significant adverse effects on our business, future incidents in which we do not receive timely or complete information regarding the nature or scope of a cybersecurity event could impair our response and could have a material adverse effect on our business. Cyberattackers are also increasingly exploiting vulnerabilities in commercially available software from shared or open-source code. We rely on third party commercial software that have had and may have such vulnerabilities, but as use of open-source code is frequently not disclosed, our ability to fully assess this risk to our systems is limited. Although these vulnerabilities did not result in any significant adverse effects on us, there can be no assurances that a similar future vulnerability in the software and services that we use would not result in a material adverse effect on our business or results of operations. Domestic and global government regulators, our business partners, suppliers with whom we do business, companies that provide us or our partners with business services and companies we have acquired or may acquire face similar risks. Security breaches of their systems or service outages have adversely affected systems and could, in the future, affect our systems and security, leave us without access to important systems, products, raw materials, components, services or information, or expose our confidential data or sensitive personal information. For example, we have experienced cybersecurity incidents at third-party vendors that provide testing, analytical, information technology and clinical data services, which required us to temporarily disconnect our systems from those vendors. Although these incidents did not result in breaches of our systems or significantly affect product availability, a prolonged or more widespread service outage affecting these or other vendors, particularly where a vendor is a single source for critical services, could have a material adverse effect on our business or results of operations. In 2024, Change Healthcare, a large U.S. insurance claim and co-pay card processing clearinghouse, experienced a ransomware attack that has caused significant disruptions to healthcare provider and pharmacy operations. While Change Healthcare does not directly provide us with services, disruptions to co-pay card support, insurance billing and Medicaid rebate processing led to lost sales and required us to take action to help patients access their medications and to provide extended payment terms to certain customers. Although services have been rerouted and restored, and the impact on our business was immaterial, similar disruptions may occur in the future stemming from the interconnectedness of the U.S. healthcare ecosystem and industry reliance on centralized claims processing systems and networks, and such future disruptions may have a material adverse effect on our business or results of operations. In addition, we distribute our products in the United States primarily through three pharmaceutical wholesalers, and a security breach that impairs the distribution operations of our wholesalers could significantly impair our ability to deliver our products to healthcare providers and patients. There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls, or procedures, will be fully implemented, complied with or effective in protecting our information technology systems and sensitive data. Although we have experienced system breakdowns, attacks and information security breaches, we do not believe such breakdowns, attacks and breaches have had a material adverse effect on our business or results of operations. We will continue to experience varying degrees of cyberattacks and other incidents in the future. Even though we continue to invest in the monitoring, protection and resilience of our critical and/or sensitive data and systems, there can be no assurance that our efforts will detect, prevent or fully recover systems or data from all breakdowns, service interruptions, attacks and/or breaches of our systems that could adversely affect our business and operations and/or result in the loss or exposure of critical, proprietary, private, confidential or otherwise sensitive data, which could result in material financial, legal business or reputational harm to us or negatively affect our stock price. While we maintain cyber-liability insurance, our insurance is not sufficient to cover us against all losses that could potentially result from a service interruption, breach of our systems or loss of our critical or sensitive data. We are also subject to various laws and regulations globally regarding cybersecurity, privacy and data protection, including laws and regulations relating to the collection, storage, handling, use, disclosure, transfer and security of personal data. The legislative and regulatory environment regarding privacy and data protection continues to evolve and receive significant attention globally. For example, we are subject to the EU's General Data Protection Regulation and the California Consumer Privacy Act, as amended (CCPA), both of which impose comprehensive data protection obligations and provide for substantial penalties for noncompliance. Similar consumer privacy and data protection laws have been enacted or proposed in more than half of U.S. states, many of which impose obligations and restrictions that are comparable to, or in some cases more stringent than, those under the CCPA. Outside the United States, other jurisdictions where we operate have passed, or continue to propose, data privacy or cybersecurity legislation and/or regulations. For example, in China, the Personal Information Protection Law and the Data Security Law, which regulate data processing activities associated with personal and nonpersonal data, builds upon the existing Cybersecurity Law. Failure to comply with these current and future laws could result in significant penalties and reputational harm and could have a material adverse effect on our business and results of operations. We are adopting and exploring the use of AI in our business, and as an emerging and rapidly evolving technology, our use of AI introduces potential opportunities but also presents risks that could adversely affect our operations, information security and reputation. AI systems may produce inaccurate or flawed outputs due to flawed algorithms, or insufficient and/or erroneous training data. Reliance on flawed outputs could prevent us from effectively utilizing AI in our business or result in lower quality decision-making. We may also become vulnerable to operational disruptions if the AI technologies we use experience downtimes or are compromised by cyberattacks. If we do not effectively implement guardrails and train our staff on the safe and proper use of AI, or if our staff fail to effectively adhere to our established guardrails and training on the use of AI, we may experience adverse effects on our business, including data breaches, the loss of confidential information (including our intellectual property), unintentional disclosure of personal data, or other misuse of our proprietary information. The market for AI technologies also varies significantly in maturity, security, transparency and reliability, and AI tools and platforms we evaluate, deploy or use, including those provided by third parties, may not perform as expected or provide sufficient capabilities to address evolving operational or cybersecurity needs. Certain AI-enabled tools, including AI-driven cybersecurity tools, are designed to rapidly identify vulnerabilities, misconfigurations and control gaps, increasing the volume and speed at which potential exposures are identified, and are likely to accelerate malicious activities by threat actors and increase the likelihood and/or severity of cyber incidents. If we do not effectively assess, implement, govern and update these technologies, we may experience increased cybersecurity risks, operational inefficiencies or reduced effectiveness of our security controls. Further, several governments and regulatory authorities have proposed or passed laws and regulations governing the use of AI. For example, the European Parliament has adopted the Artificial Intelligence Act establishing EU-wide rules on data quality, transparency, human oversight and accountability with respect to the use of AI, and U.S. federal and state governments, including California, have enacted or are considering laws regulating the development and use of AI. In 2024, the EU also revised its Cybersecurity Directive NIS2 rules that create new cybersecurity risk management and reporting obligations. Failure to comply with these current and future laws could result in significant penalties and reputational harm and could have a material adverse effect on our business and results of operations.