recalled<\/a> in 2023 over cybersecurity concerns.<\/p>\nThursday\u2019s settlement was obtained through a joint effort by the U.S. Attorney\u2019s Office for the District of Rhode Island and the Justice Department\u2019s Civil Division, Commercial Litigation Branch and Fraud Section, with additional assistance from other federal investigators.<\/p>\n
Among the federal agencies that purchased and used vulnerable Illumina products from 2016 to 2023 were the Departments of Justice, Health and Human Services, the Interior, Energy, Commerce and Veterans Affairs, as well as the Smithsonian, the National Aeronautics and Space Administration (NASA), and the Army, Navy, and Air Force.<\/p>\n
Since 2001, Illumina has received $530 million in direct federal funding, with $43 million in 2022 alone, according to court documents. It also receives pass-through money via Medicare reimbursements, as clinical labs use Illumina systems for genetic testing.<\/p>\n
The security issues in Illumina\u2019s products \u201callowed thousands of Illumina insiders and everyday users of its products the ability to access and manipulate HIPAA-protected patient genomic data, including test results and to do so without detection,\u201d the suit argued.<\/p>\n
Christine Douglass, a spokesperson for Illumina, shared a statement via email Thursday that denied the allegations. The company settled, Douglass wrote, to forego \u201cthe uncertainty, expense, and distraction of litigation.\u201d As part of the settlement, it did not admit any wrongdoing.<\/p>\n
\u201cGovernment agencies, including the U.S. Food and Drug Administration (FDA), are important customers and Illumina values these relationships,\u201d Douglass said. \u201cIllumina takes data security seriously and has invested significantly in its programs to align with cybersecurity best practices for the development and deployment of our products. We are pleased to put this matter behind us.\u201d<\/p>\n
Douglass said that Illumina \u201csuccessfully remediated\u201d security issues for its customers from 2022 to 2024.<\/p>\n
\n What the lawsuit says <\/p>\n
The 72-page lawsuit explains that Illumina is the only servicer for its products, like the MiniSeq and NextSeq, both of which are named in the suit. Because Illumina is the only servicer for its products across their lifecycle, the company needs to contract with government agencies to provide maintenance as needed.<\/p>\n
The lawsuit alleged these government contracts were violated when it was discovered that Illumina had been selling products with unaddressed security holes, such as human-readable passwords coded into software.<\/p>\n
\u201cIllumina improperly hard-coded credentials used to access confidential patient genomic data stored in the cloud, allowing everyday users to see the login information in plain text,\u201d the lawsuit alleged.<\/p>\n
Another vulnerability involved software that was too liberal with elevated privileges for user accounts. That meant that \u201cthousands of everyday users,\u201d could exert considerable control over Illumina systems.<\/p>\n
\u201cIllumina has improperly allowed elevated privileges to users running genetic tests on Illumina products that are connected to an open network,\u201d the suit reads. \u201cThese users include everyone \u2014 research assistants, third-party vendors, laboratory technicians, scientists, clinical investigators, engineers, and research and development staff \u2014 individuals who have no need for access to confidential and HIPAA-protected patient data including genomic test results.\u201d<\/p>\n
Federal prosecutors strengthened their case for False Claims Act liability with several eyebrow-raising examples that the company was verifying compliance with government standards while knowing otherwise. In 2022, Illumina initiated a product recall only after its customer, the pharmaceutical giant Roche, informed it of a vulnerability in its sequencing software. Roche routinely tests software and hardware it uses for security flaws, but according to prosecutors, Illumina had not performed its own testing on the product in question.<\/p>\n
The lawsuit says that, in another instance, an internal Illumina report noted that a product it was about to launch could most likely be hacked by \u201ca disgruntled ex- or current staff member, with access to the [local] network.\u201d Illumina launched the product three days later and did not disclose the security concerns to the feds.<\/p>\n
Lumina did recall products multiple times, but the court complaint calls some of these efforts a \u201chalf-truth,\u201d as Illumina allowed different products with the same vulnerabilities to stay on the market.<\/p>\n
The company, which made $4.372 billion last year, accounts for about 80% market share of the genomic sequencing industry. Their products are used in research, medicine, and commercial gene testing.<\/p>\n
\u201cIllumina\u2019s cybersecurity failures have been driven by its singular goal to maintain its dominant market presence,\u201d the complaint reads. \u201cWhen faced with customer complaints related to the accessibility of data in its products, Illumina took fatal shortcuts.\u201d<\/p>\n
Whistleblower Lenore \u2014 described in the complaint as a \u201crespected professional in the field of life sciences technologies and was hired by Illumina to oversee all of Illumina\u2019s on-market products\u201d \u2014 noticed some of these shortcuts during her time at the company, during which she balanced overlapping roles in product management.<\/p>\n
Lenore became concerned about security issues that popped up and repeatedly brought her concerns to higher-ups, but was \u201cignored, reprimanded, marginalized, and retaliated against by Illumina.\u201d Lenore ultimately lost her job in what the company called a \u201crestructuring,\u201d the lawsuit reads.<\/p>\n
This story was originally published by the Rhode Island Current.<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"The world\u2019s leading manufacturer of DNA sequencing systems will pay $9.8 million to resolve allegations that it knowingly…\n","protected":false},"author":2,"featured_media":60192,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[50],"tags":[200,79],"class_list":["post-60191","post","type-post","status-publish","format-standard","has-post-thumbnail","category-genetics","tag-genetics","tag-science"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/posts\/60191","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/comments?post=60191"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/posts\/60191\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/media\/60192"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/media?parent=60191"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/categories?post=60191"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/tags?post=60191"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}