Vendor and cloud-tenant breaches in 8-K filings: entry point, data, responsibility

What this guide covers

Some 8-K cyber disclosures do not describe a break-in on the company's own network. They describe activity somewhere else: an integration, a vendor, or a cloud service run by another party. This guide reads four such filings and pulls out three things from each. Where did the activity enter? What data does the company say was taken? Who ran the environment where it happened?

Every claim below comes from the text of the filings and is attributed to the filing that makes it. The filings are short, and they say different amounts about each question. Where a filing says nothing, this guide says nothing either. The filers are named in the sections that follow.

Entry point: an integration, a cloud environment, a vendor of a vendor

The four filings describe different kinds of entry, and the wording matters because each puts the weak point in a different place.

The 8x8 filing, made under Item 1.05, says an unauthorized third party threat actor exploited the Klue Labs, Inc. integration. The company's filing puts the access window between June 11 and June 12, 2026. In this case the entry point is a named integration, not the company's own login or network.

Amgen's Item 1.05 filing does not name a vendor or an integration. It says the company identified unauthorized activity involving data stored in cloud environments hosted by third-party cloud service providers. The filing describes the location of the data, not a method of entry.

Live Nation Entertainment filed under Item 8.01, not Item 1.05. Its filing says the company identified unauthorized activity within a third-party cloud database environment. As with Amgen, the filing text names the kind of environment and does not describe how the activity began.

The Federal Home Loan Bank of New York describes a more distant link. It says its operational controls detected unknown persons attempting to fraudulently obtain funds. The Bank then says it determined that a fourth-party vendor had been compromised, and that this caused the incident. The filing defines the term in parentheses as a vendor of a Bank vendor.

Data taken: specific lists, open assessments, and no data at all

The filings differ most on what they say was taken.

8x8 gives a list. The company says the exfiltrated material included fragmented contract and opportunity information, sales team notes, and contact information. It also sets a boundary. It says its investigation to date indicates the incident was isolated to information in its Salesforce system that was reachable through the Klue integration.

Amgen gives categories and says the picture is not complete. The company says some of its data has been exfiltrated from the cloud environments, naming proprietary data and patient protected health information. In the same filing, Amgen says it is still working out the extent of exposure across several categories of information.

Live Nation does not list data types in its filing. It reports an outside event: a criminal threat actor offered what it alleged to be company user data for sale on the dark web. The word "alleged" is in the filing, so the company is describing the offer, not confirming the contents.

The Federal Home Loan Bank of New York reports no data theft. It says no unauthorized transactions were executed and no money was transferred to the unknown persons. The incident it describes was an attempt to obtain funds, not an exfiltration.

Who ran the environment, and who responded

A reader of these filings usually wants to know whose system it was. The filings answer through how they assign the environment and the response.

The Federal Home Loan Bank of New York is the most direct. It says its own information technology systems and networks were not compromised or affected. In its account, the compromised system belonged to a vendor of one of its vendors.

8x8 describes a shared response across three parties. The company says that 8x8 and Klue, with support from Salesforce, took immediate steps to disable the compromised integration. The filing names the integration provider and the platform provider, and it describes the integration as connected to 8x8's own Salesforce system.

Amgen describes its own response, not the provider's. It says it activated its cybersecurity response plan, implemented containment measures, and engaged independent cybersecurity forensic experts. The filing does not say what the cloud providers did or name them.

Live Nation describes law enforcement involvement. It says the company has notified law enforcement and is cooperating with it. The filing does not say what the third-party cloud provider did.

None of the four filings assigns fault in the text. They say whose environment was involved and what the filer did next. That is a reading of the filings as written, not a judgment about any party.

Which item the companies used

The choice of form item is part of what these filings say. 8x8 states that it determined the incident was reportable under Item 1.05 because of the nature of the information accessed. Amgen dates its materiality determination: on July 29, 2026, it evaluated the volume of files that appear to have been affected. Live Nation's filing sits under a different heading, Item 8.01 Other Events.

The filings thus reach the 8-K by different routes. One company cites the nature of the data. One cites the volume of files. One uses the "Other Events" item instead of the cybersecurity item.

What the filings leave open

These are first disclosures, and some are explicit that they are incomplete. Amgen says it will amend its Form 8-K as information is determined or becomes available. A reader tracking the Amgen incident should therefore expect the filing to change.

Across the four documents, there are three things to check on any filing of this kind:

• Does the text name the vendor or integration, or only the type of environment?
• Does it list the data taken, or only say an assessment continues?
• Does it say whose environment was compromised, and who responded?

Taken together, the four filings answer those questions to different degrees. 8x8 names the integration and the platform and lists the data. Amgen and Live Nation name the type of environment and say less about method. The Federal Home Loan Bank of New York places the compromise two steps from its own network and says its systems were not affected.