Illumina Inc., a company based in Delaware and headquartered in California, has agreed to pay $9.8 million to settle allegations that it violated the False Claims Act by selling genomic sequencing systems with cybersecurity vulnerabilities to federal agencies.
According to the settlement, from February 2016 through September 2023, Illumina sold these systems without having an adequate security program or sufficient quality controls to identify and address software vulnerabilities. The U.S. government alleged that Illumina knowingly did not include product cybersecurity in its software design, development, installation, or ongoing monitoring. The company was also accused of failing to provide proper support and resources for personnel and processes responsible for product security, not adequately correcting design features that introduced vulnerabilities, and falsely representing compliance with cybersecurity standards set by organizations such as the International Organization for Standardization and National Institute of Standards and Technology.
“Companies that sell products to the federal government will be held accountable for failing to adhere to cybersecurity standards and protecting against cybersecurity risks,” said Assistant Attorney General Brett A. Shumate of the Justice Department’s Civil Division. “This settlement underscores the importance of cybersecurity in handling genetic information and the Department’s commitment to ensuring that federal contractors adhere to requirements to protect sensitive information from cyber threats.”
“This settlement demonstrates our continuing commitment to combat cybersecurity risks by ensuring that federal contractors protect private and sensitive government information.” said Acting U.S. Attorney Sara Bloom for the District of Rhode Island.
“This settlement demonstrates our continued commitment to work with our law enforcement partners and the Department of Justice to ensure companies fulfill their contractual obligations,” said Acting Special Agent in Charge Christopher M. Silvestro of the Defense Criminal Investigative Service (DCIS) Northeast Field Office, the law enforcement arm of the Department of Defense’s Office of Inspector General. “Safeguarding the validity of Department of Defense research and data is vital to supporting the warfighter.”
“Significant damage can result from a failure to adhere to required cybersecurity standards, especially when the systems involved include sensitive genomic data,” said Special Agent in Charge Roberto Coviello of the U.S. Department of Health and Human Services Office of Inspector General (HHS-OIG). “HHS-OIG and our law enforcement partners remain dedicated to ensuring that entities who do business with the government uphold their cybersecurity obligations.”
The case began as a lawsuit filed under whistleblower provisions within the False Claims Act, which allows private individuals—known as relators—to sue on behalf of the government if they believe false claims have been submitted for government funds. Erica Lenore, identified as a former Director for Platform Management at Illumina, will receive $1.9 million as her share from this settlement.
Multiple agencies collaborated on this investigation including units from both Justice Department’s Civil Division and United States Attorney’s Office for Rhode Island along with DCIS, Army Criminal Investigation Division, HHS-OIG, and Commerce OIG.
The agreement states that these are allegations only; no liability determination has been made.
