Amgen: Form 8-K Item 1.05 cybersecurity incident

1. Incident summary

Amgen Inc. disclosed a material cybersecurity incident under Item 1.05 [8-K 0000318154-26-000119 Item 1.05]. The engine extracted the following fields from the filing. Each carries the label shown.

• Incident type: data_exfiltration (derived) [8-K 0000318154-26-000119 Item 1.05].
• Systems affected: cloud environments hosted by third-party cloud service providers (derived) [8-K 0000318154-26-000119 Item 1.05].
• Data types compromised: PHI (derived) [8-K 0000318154-26-000119 Item 1.05].
• Containment status: unknown (derived) [8-K 0000318154-26-000119 Item 1.05].
• Operational status: fully_operational (analyst-confirmed) [8-K 0000318154-26-000119 Item 1.05].

The engine assigned an overall materiality tier of moderate in each of the low, base and high scenarios, with 0 unscored cases. Materiality tiers are internal calibration. They are not ratings [scoring.yaml combination].

2. Business Risk

• The Business Risk tier is moderate in all three scenarios. This follows the internal calibration rule for cyber events, which treats PHI exposure outside data-intensive sectors as meeting the moderate rule [scoring.yaml business_tier_rule_cyber].
• The issuer is mapped to the pharma_devices sector through the internal SIC map. That sector is not treated as data-intensive for this rule [scoring.yaml cyber.sector_map] [scoring.yaml cyber].
• The compromised data type is PHI [8-K 0000318154-26-000119 Item 1.05]. Under the internal cyber calibration, the data type and the sector together drive the business tier, not operational disruption [scoring.yaml cyber].
• The issuer is analyst-confirmed as fully operational. Every scenario therefore uses 0 outage days, with the basis "fully operational: no outage" [scoring.yaml cyber].
• The affected unit share is 1.0 (derived) because the issuer has a single reportable segment. The full business is in scope of the profile, but with 0 outage days no disruption fraction applies [scoring.yaml cyber].

3. Financial Risk

• Core ratios are measured against the standard table, Table 17. This is the engine default. The criteria select the table from industry and country risk, which the engine does not compute, so the table choice is internal calibration [corporate_methodology p.33]. The medial and low tables are alternative tables under the criteria [corporate_methodology p.34].
• Pre-event FFO/debt is 12.91%, in band index 4 (12% to 20%). Its relative distance to the 12% boundary is 0.0755 [corporate_methodology p.33].
• Pre-event Debt/EBITDA is 3.83x, in band index 3 (3x to 4x). Its relative distance to the 4x boundary is 0.0418 [corporate_methodology p.33].
• Both ratios are less than 10% in relative terms from a range boundary. They therefore meet the criteria description of borderline [corporate_methodology p.32].
• Lost EBITDA is $0M in the low, base and high scenarios. Post-event ratios are unchanged at 12.91% and 3.83x, with 0 band movement on either ratio [scoring.yaml cyber] [corporate_methodology p.33].
• The Financial Risk tier is moderate in all scenarios. The internal rule assigns this tier because the ratios sit within 0.1 relative distance of a band boundary, even though no band changed [scoring.yaml financial_tier_rule].
• The supplied inputs used for these ratios are FFO $7,047M (derived), debt $54,604M (derived) and EBITDA $14,247M (derived) [corporate_methodology p.33]. Other supplied cash flow inputs are CFO $9,958M (verified), FOCF $8,100M (derived), DCF $2,976M (derived), cash interest $2,900M (verified) and operating lease liabilities $831M (verified) [corporate_methodology p.33].
• The ratios are as-reported proxies. S&P adjustments are not applied. EBITDA and FFO are non-GAAP measures and are treated as unverified [corporate_methodology p.33].
• The inputs present fiscal year 2025 values. The criteria apply five-year time weights of 10/15/25/25/25, which this memo does not reproduce [corporate_methodology p.32].

4. Liquidity

• Liquidity was not scored. Its state is insufficient_data because a required source or use is missing. Under internal calibration, a missing input is never treated as a pass [scoring.yaml liquidity.gate_rule].
• The missing inputs are:
  • contracted_asset_sales
  • contracted_acquisitions
  • working_capital_change_12m
  • expected_shareholder_distributions
  • undrawn_committed_facilities_maturing_beyond_12m These items fall within the sources and uses of liquidity that the criteria count [liquidity_descriptors p.8] [liquidity_descriptors p.9].
• Without these inputs, the engine cannot test two reference levels. The first is sources over uses of at least 1.2x. The second is sources minus uses staying positive after a 15% EBITDA decline [liquidity_descriptors p.13]. The engine also cannot test the reference level of sources over uses below 1.2x [liquidity_descriptors p.16].
• XBRL proxies cover some liquidity inputs, such as prior-year capex and 12-month maturities. They do not substitute for the missing items listed above [scoring.yaml liquidity.xbrl_proxies].
• A null liquidity tier is not a low tier. The overall tier skips this dimension rather than counting it as benign [scoring.yaml combination].

5. Governance

• No governance flags were supplied, so no governance overlay was applied [scoring.yaml overlay_rule].
• The governance overlay is downside only and moves the tier by one step at most. It cannot reduce assessed materiality [scoring.yaml overlay_rule].
• The overall tier of moderate is the worst of Financial Risk, Business Risk and Liquidity, with no weighted average. Liquidity is skipped here because it has no tier [scoring.yaml combination].
• Containment status is unknown (derived) [8-K 0000318154-26-000119 Item 1.05]. Later disclosure on containment or oversight could produce governance flags, which the overlay would assess [scoring.yaml overlay_rule].

6. Key watch factors

• Containment status: containment is unknown (derived). A disclosure that changes operational status from fully_operational would introduce outage days into the cyber scenarios [scoring.yaml cyber] [8-K 0000318154-26-000119 Item 1.05].
• Scope of PHI exposure: further detail on the PHI involved, or on the third-party cloud environments, bears on the business tier under the cyber rule [scoring.yaml business_tier_rule_cyber].
• Borderline ratio positions: FFO/debt at 12.91% (distance 0.0755) and Debt/EBITDA at 3.83x (distance 0.0418) sit near band boundaries. Any EBITDA or debt change linked to the incident could move a ratio across a boundary [corporate_methodology p.32] [scoring.yaml financial_tier_rule].
• Liquidity data gaps: supplying the five missing inputs would allow the liquidity gate to be scored against the reference levels [scoring.yaml liquidity.gate_rule] [liquidity_descriptors p.13].
• Table selection: the standard table is an engine default. A different table chosen from industry and country risk would change the band ranges applied [corporate_methodology p.33] [corporate_methodology p.34].
• Governance flags: any governance flag raised by later filings would trigger the downside-only overlay [scoring.yaml overlay_rule].

7. Sources

Filing

• [8-K 0000318154-26-000119 Item 1.05], Amgen Inc., Form 8-K, Item 1.05. https://www.sec.gov/Archives/edgar/data/318154/000031815426000119/amgn-20260729.htm

Criteria excerpts

• [corporate_methodology p.32]: Corporate Methodology, para 116 (five-year ratio time weights) and para 118 (borderline within 10% relative distance).
• [corporate_methodology p.33]: Corporate Methodology, Table 17 (standard ratio ranges) and para 123 (table selection from industry and country risk).
• [corporate_methodology p.34]: Corporate Methodology, Table 18 (medial ratio ranges) and Table 19 (low ratio ranges).
• [liquidity_descriptors p.8]: Liquidity Descriptors For Global Corporate Issuers, para 23 (sources of liquidity).
• [liquidity_descriptors p.9]: Liquidity Descriptors For Global Corporate Issuers, para 30 (uses of liquidity).
• [liquidity_descriptors p.13]: Liquidity Descriptors For Global Corporate Issuers, para 37 (reference levels: 1.2x and 15% EBITDA decline).
• [liquidity_descriptors p.16]: Liquidity Descriptors For Global Corporate Issuers, para 40 (sources over uses below 1.2x).

Internal calibration (docs/scoring/scoring.yaml)

• [scoring.yaml financial_tier_rule]: Financial Risk tier rule.
• [scoring.yaml business_tier_rule_cyber]: Business Risk tier rule for cyber events.
• [scoring.yaml cyber]: cyber shock parameters.
• [scoring.yaml cyber.sector_map]: SIC to sector map.
• [scoring.yaml liquidity.gate_rule]: liquidity gate states.
• [scoring.yaml liquidity.xbrl_proxies]: XBRL proxies for liquidity inputs.
• [scoring.yaml overlay_rule]: governance overlay, downside only.
• [scoring.yaml combination]: overall tier as worst dimension.

8. Disclaimers

• This memo is an analytical aid. It is not a credit rating or a rating recommendation and does not represent the view of any rating committee.
• Based only on public information. Figures are as-reported in SEC filings unless labeled derived or estimate.
• Materiality tiers (low, moderate, elevated, high) are internal calibration. They are not ratings.
• Ratios are as-reported proxies without S&P adjustments. Non-GAAP figures, including EBITDA and FFO, are treated as unverified.