When unauthorized actors access your cloud storage, you're racing against three clocks: forensic investigation, regulatory notification windows, and threat containment. The unauthorized access to Amgen's third-party-hosted cloud storage systems in July 2026 shows what happens when cloud security controls fail at scale. Proprietary data, protected health information, and other sensitive information were exfiltrated before detection. For CISOs in healthcare and life sciences, this scenario is a pressing threat you need to address this quarter.
The Problem: Why This Matters Now
Cloud storage breaches in healthcare create compounding regulatory obligations. You're not just managing HIPAA's 72-Hour Notification Requirement. You're also assessing SEC disclosure thresholds if you're publicly traded, state breach notification laws across multiple jurisdictions, and potentially contractual obligations to research partners or clinical trial participants.
The forensic challenge adds to the regulatory pressure. When Amgen engaged third-party digital forensics experts, they needed to determine what was exfiltrated before assessing notification scope. That investigation timeline doesn't pause your regulatory clocks. You need controls in place before the breach, not detective capabilities you assemble afterward.
Recent attacks on Novo Nordisk, Medtronic, Stryker, Abbott Laboratories, and West Pharmaceutical Services show that threat actors are systematically targeting pharmaceutical and medtech cloud environments. Groups like ShinyHunters have developed repeatable techniques for healthcare sector exploitation. Your cloud storage isn't an edge case anymore. It's a primary attack surface.
What You Need Before Starting
Before implementing cloud storage security controls, inventory what you're protecting:
Access Audit: Export current Identity and Access Management (IAM) policies from your cloud provider. You need a complete list of who has access to each storage bucket, what permissions they hold, and when those permissions were last used. In AWS, run aws iam get-account-authorization-details and parse the output. In Azure, use az role assignment list --all to enumerate permissions across subscriptions.
Data Classification Map: You can't apply appropriate controls without knowing what's in each storage location. Run automated discovery tools (Microsoft Purview, AWS Macie, or open-source alternatives like CloudCustodian) to identify protected health information, personally identifiable information, and intellectual property. Tag buckets based on data sensitivity before applying security policies.
Existing Logging Baseline: Check whether CloudTrail (AWS), Azure Monitor Logs, or Google Cloud Logging are enabled and forwarding to a SIEM. You need at least 90 days of historical access logs to establish normal behavior patterns before you can detect anomalies.
Third-Party Integrations Inventory: List every application, research partner, or vendor with programmatic access to your cloud storage. These service accounts often hold overly broad permissions and rarely get reviewed.
Step-by-Step Implementation
Week 1-2: Lock Down Authentication
Enforce multi-factor authentication for all human users accessing cloud storage. In AWS, create an IAM policy that denies all actions unless MFA is present:
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Deny",
"Action": "*",
"Resource": "*",
"Condition": {
"BoolIfExists": {"aws:MultiFactorAuthPresent": "false"}
}
}]
}
Attach this policy to all user accounts. For service accounts and API access, rotate to short-lived credentials using AWS STS AssumeRole or Azure Managed Identities. Permanent API keys are authentication liabilities you can't afford.
Week 3-4: Implement Principle of Least Privilege
Remove wildcard permissions from all IAM policies. Replace s3:* with explicit action lists. For each user or service account, document the business justification for their access level.
Create Role-Based Access Control policies that separate duties. Research teams shouldn't have delete permissions on production data stores. Finance teams don't need access to clinical trial data buckets. Use IAM conditions to restrict access by IP range, time of day, or request origin where appropriate.
Week 5-6: Enable Comprehensive Logging and Monitoring
Configure object-level logging for all storage buckets containing sensitive data. In AWS, enable S3 Data Events in CloudTrail. In Azure, enable diagnostic logging for Blob Storage with read and write operations captured.
Forward these logs to your SIEM with correlation rules that alert on:
- Access from new geographic locations
- Bulk download operations exceeding normal thresholds
- Access outside business hours by user accounts
- Permission changes to bucket policies
- Encryption setting modifications
Set up automated responses using cloud-native tools. AWS Lambda functions can automatically revoke suspicious access and trigger incident response workflows.
Week 7-8: Encrypt Everything with Customer-Managed Keys
Enable encryption at rest using keys you control, not provider-managed defaults. In AWS, use KMS Customer Managed Keys. Configure key policies that require explicit approval for key usage and log all encryption operations.
Enforce encryption in transit by setting bucket policies that deny unencrypted uploads:
{
"Effect": "Deny",
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::your-bucket/*",
"Condition": {
"StringNotEquals": {
"s3:x-amz-server-side-encryption": "aws:kms"
}
}
}
Week 9-12: Implement Zero Trust Architecture Boundaries
Deploy network controls that prevent direct internet access to storage buckets. Use VPC endpoints (AWS PrivateLink) or Azure Private Link to ensure traffic flows through your controlled network perimeter.
Configure bucket policies that deny access unless requests originate from approved VPCs or private endpoints. Add IP allowlisting for third-party integrations that can't use private connectivity, and require those connections to authenticate through your identity provider.
Enable versioning and object lock for compliance-critical data. HIPAA requires you to maintain audit trails and prevent unauthorized alteration. Object lock provides immutability that protects against both external attackers and malicious insiders.
Validation: How to Verify It Works
Run quarterly penetration tests focused on cloud storage access paths. Your test scope should include:
- Credential compromise scenarios (stolen API keys, phished user accounts)
- Privilege escalation attempts from low-privilege accounts
- Data exfiltration simulations to test detection thresholds
- Encryption bypass attempts
Conduct tabletop exercises with your Computer Security Incident Response Team that simulate cloud storage breaches. Walk through the forensic investigation process Amgen faced: determining what was accessed, when unauthorized activity began, and what data was exfiltrated. If you can't answer those questions within 24 hours using your current logging, your detective controls are insufficient.
Review IAM policies monthly using automated policy analysis tools. AWS IAM Access Analyzer and Azure Policy identify overly permissive configurations. Fix findings within your defined SLA based on data sensitivity.
Maintenance: Ongoing Tasks
Monthly: Review access logs for anomalies your automated rules didn't catch. Look for gradual permission creep, dormant accounts that suddenly activate, or unusual data access patterns that fall below alert thresholds.
Quarterly: Audit and recertify all service account permissions. Require business owners to justify continued access. Revoke permissions for accounts that haven't been used in 90 days.
After Any Organizational Change: Departing employees, acquired companies, new research partnerships, and vendor relationships all create access control gaps. Trigger immediate reviews of cloud storage permissions when these events occur.
Annually: Engage third-party auditors to validate your controls against HIPAA Security Rule requirements (specifically 45 CFR §164.312(a)(1) for access controls and §164.312(e)(1) for transmission security). If you're pursuing SOC 2 Type II certification, map your cloud storage controls to the Confidentiality and Availability trust services criteria.
The regulatory notification requirements Amgen is assessing don't start after you detect a breach. They're determined by the controls you implemented beforehand. Your ability to demonstrate you applied appropriate safeguards, maintained audit trails, and detected unauthorized access promptly directly impacts your regulatory exposure. Build those capabilities now, while you control the timeline.
