Health data in 8-K cyber filings: Cencora, Amgen and AdaptHealth compared

The three questions this guide answers

This guide reads four documents on SEC EDGAR: Cencora's Form 8-K and its later amendment, Amgen's Form 8-K, and AdaptHealth's Form 8-K. It asks the same three things of each. Which health data does the filing say was taken? How does the filing say the data was reached? When did the health-data finding appear in the public record? Every statement below is attributed to the company that made it. Where a filing is silent on one of the questions, the guide says so and does not fill the gap.

Cencora: personal information first, health information in the amendment

Cencora's first report described the exposed data only as personal information. The original Form 8-K says the company learned on February 21, 2024 that data had been taken, with the filing stating that it "learned that data from its information systems had been exfiltrated, some of which may contain personal information."

The amendment is where the health data appears. Its explanatory note says it amends the original report that Cencora filed on February 27, 2024. The amendment carries a signature date of July 31, 2024.

The amendment explains why the picture changed. Cencora says its investigation showed that more data had been taken than first identified.

On the data itself, the amendment says the company's review "has confirmed that the Data included personally identifiable information" and protected health information of individuals. It adds that most of that information sits with a particular part of the group, stating that it is "most of which is maintained by a Company subsidiary that provides patient support services."

The amendment also reports on notification. Cencora says that for the PII and PHI found to date, it has provided required notifications to potentially affected parties and individuals as well as regulatory agencies.

On the second question, neither Cencora document in this set describes how the data was reached. The filings refer to "unauthorized activity" and to exfiltration, and they do not name an access method.

Amgen: patient health information named in the first findings

Amgen's Form 8-K names patient protected health information in its description of what was taken. It says that in July 2026 the company identified unauthorized activity involving data stored in cloud environments hosted by third-party cloud service providers. That is the filing's answer on how the data was reached: through cloud environments, as opposed to a described technique.

On which data was taken, Amgen says it has learned that some of its data, "including proprietary data, patient protected health information, and other information, has been exfiltrated from these cloud environments."

Amgen is explicit that the health-data finding is not complete. It says it continues to assess whether, and to what extent, patient, confidential business information, intellectual property, research and development, or other information may have been accessed, acquired, or exfiltrated.

The filing also gives a date for the materiality decision. Amgen says that on July 29, 2026, based on the volume of files that appear to have been impacted and the potential that the information in them could be sensitive, it determined the incident is material.

On patients, Amgen says it will make all required notifications based on its findings, including to impacted patients.

AdaptHealth: the access path and data types in one filing

AdaptHealth's Form 8-K gives the most detail on the second question. The company says it believes a threat actor gained unauthorized access to certain cloud-based business applications, including internal patient management systems and document storage platforms.

It also gives a dated first contact. AdaptHealth says that on June 15, 2026 it received a communication from a threat actor claiming to have obtained certain data.

The filing separates what was taken from what was only accessed. AdaptHealth says it confirmed that certain external electronic health record system portals were accessed by the threat actor.

On the data affected, the company says it includes passwords associated with insurance billing and certain personally identifiable information and protected health information of patients.

The filing also states what it says was not in the affected systems. AdaptHealth says it does not collect Social Security numbers there and does not store individual financial account information or payment card information in those systems.

On cause, AdaptHealth states that the incident came from a successful social engineering attack that compromised a user session associated with a third-party contractor.

It reports a materiality date and its reason. AdaptHealth says that on June 27, 2026 it determined the incident is material because of the nature and potential volume of the data at risk.

The filing is open about its limits. AdaptHealth says the full scope of affected data sets has not been determined and that specific information about the volume of data is not yet available.

How the three compare on the three questions

On which health data was taken, the filings use different levels of precision. Cencora's amendment uses the terms PII and PHI. Amgen uses "patient protected health information". AdaptHealth pairs PHI with named items such as insurance billing passwords and electronic health record portal access.

On how the data was reached, the filings again differ. Amgen points to third-party cloud environments. AdaptHealth names business applications, patient management systems, document storage, portals, and a social engineering attack. Cencora's two documents do not describe an access method.

On when the health-data finding came out, the order of events differs. Cencora's first filing named only personal information, and the amendment came later with the PHI finding. Amgen's filing names patient protected health information in its description of what was taken, while saying the assessment continues. AdaptHealth's filing names PHI and describes the health record portals, while saying the scope is not yet known.

What the filings leave open

None of these documents gives a final count of people or records. Amgen and AdaptHealth both describe ongoing work, and Cencora's amendment describes a continuing review. A reader tracking a health-data incident should therefore treat each 8-K as a statement of what the company said at its filing date. Cencora's record shows that a later amendment can change the description of the data from personal information to protected health information.