Illumina: Security Promises and an Unread Inbox

In the Illumina cybersecurity settlement, Illumina agreed to pay $9.8 million to resolve allegations that it sold federal agencies genomic sequencing systems with vulnerable software and falsely represented their cybersecurity. The complaint described the alleged gap in terms a product team would recognize: excessive user access, exposed credentials, testing promises and a security inbox nobody checked. For someone who knows what the software could actually do, those details matter more than the security language in a sales document.

The Justice Department announced the settlement on July 31, 2025. Its allegations covered claims from February 24, 2016 through September 28, 2023, reaching from product design to the monitoring and correction of software already in customers’ hands.

What Illumina Sold to Federal Agencies

The settlement agreement identifies the purchased systems and their software. It names MiSeq Dx, MiSeq, NextSeq 500, NextSeq 550, NextSeq 550Dx, iScan, iSeq 100, MiniSeq, NextSeq 1000 and NextSeq 2000, operating with Local Run Manager, Universal Copy Service or both.

The complaint describes Local Run Manager as software that manages sequencing runs and analyzes data. Universal Copy Service copies genetic test results from a local product folder to cloud storage. These functions put the security question directly beside the work the government bought: running tests, handling results and moving data.

The agreement’s purchase-claim list includes the Army, Navy and Air Force alongside civilian agencies such as Health and Human Services, Veterans Affairs and NASA. The United States also entered the agreement on behalf of the Defense Logistics Agency.

What the Government Alleged About Product Cybersecurity

The government alleged that Illumina’s product-security failures extended across software design, development, installation and on-market monitoring. It also alleged inadequate support for the people and processes responsible for security, insufficient quality systems, and failures to correct design features that introduced vulnerabilities.

The representation to federal buyers was part of the alleged problem. According to the agreement, Illumina falsely represented that the software adhered to cybersecurity standards, including those of the International Organization for Standardization and the National Institute of Standards and Technology.

The government expressly described the claims as false regardless of whether an actual cybersecurity breach occurred. That makes this a concrete example of defense cybersecurity fraud allegations centered on promised protection: the government paid for products whose security, it alleged, differed from what Illumina represented. The whistleblower’s complaint linked this product-security case to the Justice Department’s Civil Cyber-Fraud Initiative.

What the Complaint Said Was Wrong With the Software

The whistleblower’s complaint described excessive user privileges, exposed credentials and failures to address insider threats. It connected those allegations to decisions about customer convenience, testing and whether known problems would be corrected.

Removing a Safeguard to Solve a Customer Problem

The complaint alleged that users were getting locked out of Local Run Manager and that Illumina disabled an access-control safeguard to solve the inconvenience. According to the whistleblower, the change gave ordinary users elevated privileges, including the ability to change configurations, disable protections and alter patient genomic test results.

A later risk analysis allegedly found that users could redirect confidential test data to a personal computer or removable drive. The same complaint said Illumina failed to conduct penetration testing of Local Run Manager despite certifying to the government that it had performed cybersecurity testing. For a software or quality employee, the comparison is concrete: the permissions a release actually grants and the testing behind the claims made for it.

Credentials in the Code, Trust in the Users

The whistleblower alleged that Illumina embedded usernames and passwords in its software, allowing access to confidential patient data without authentication. The complaint also described a decision to discount insider risk in a Local Run Manager analysis, quoting the company’s explanation:

We find that a remarkable substitute for an access control. In the complaint’s account, the software allowed the action and the security judgment rested on trusting the user not to take it.

Quality Systems and the Obligation to Fix Products

The complaint tied the alleged failures to the Food and Drug Administration’s quality-system rules for product design, corrective action and management oversight. It also alleged that customers depended on Illumina as the sole authorized maintainer of its products, with servicing contracts covering hardware maintenance and proprietary software maintenance and upgrades.

That servicing allegation connects a security defect to continuing government purchases. According to the whistleblower, Illumina failed to provide the corrections those contracts required, leaving government customers dependent on the same supplier for the remedy. The complaint also alleged federal funding through National Institutes of Health grants and purchases, and through Medicare reimbursement for tests private laboratories performed with Illumina products.

The Platform Director and the Unread Security Inbox

A former platform-management director at Illumina brought the qui tam case. Her complaint described leading a working group that examined operating-system issues and software complaints across products, placing her close to both the technical problems and the company’s response. The complaint also alleged that senior management directed the Product Security Team to ignore written mitigation policies and skip a risk-determination meeting after the team escalated known vulnerabilities.

The complaint alleged that the group discovered a security reporting channel with nobody reading it:

The Settlement and Whistleblower Share

The agreement designates $4.3 million within the settlement as restitution. It provides a $1.9 million whistleblower share. A whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers.

The Government Cannot Be Billed for the Settlement

Illumina’s agreement requires it to keep settlement-related costs out of government contract charges. Those costs include its defense, corrective actions responding to the government’s investigations, and the settlement payments. The company must account for them separately and cannot charge them directly or indirectly to a federal contract.

That distinction matters to a finance employee who knows where an expense went: a charge to one contract or a shared cost allocated across work. The agreement also requires Illumina to identify and repay covered costs previously claimed from the government. We would follow the expense, its allocation and the payment request to see whether taxpayers were being asked to fund the resolution of the allegations against their supplier.

Security on Paper and Security in Operation

Aerojet Rocketdyne agreed to a $9 million settlement over allegations that it misrepresented cybersecurity compliance on federal contracts, including defense work. Its whistleblower’s complaint alleged that the company told the government it had security equipment even when that equipment sat in a box, unconnected to the system. Illumina’s allegations concern software sold to agencies, but the comparison an insider can make is similar: what the government was told against what was actually operating.

The 2022 study Compliance and Ethics Programs in Department of Defense Government: Relationship Between Compliance and Ethics Programs and Contracting Fraud Penalty Cost, published in the International Journal of Management and Humanities, examined 49 defense contractors. It found higher penalties relative to obligated contract dollars among firms with compliance and ethics programs.

The nonrandom study offered closer government scrutiny as one possible explanation. Its finding puts the existence of a program in perspective. The product tests, warnings and management decisions tell us what that program did when a problem arrived.

What Proof Do You Need as a Whistleblower?

For allegations like these, useful evidence connects the product’s actual security to the promise made to the government and the purchase or payment. The Illumina complaint makes those connections tangible through access settings, test records, security complaints, risk analyses and decisions about correction. We work with you to understand which part of that story your knowledge explains.

A product-security specialist may know what testing revealed and who received the findings. A quality employee may know whether the company’s corrective process followed its own findings, while a contracts or billing employee may know how the security representation reached a government purchase. The value lies in joining those views around the same product, software and period.

You Know What the Software Allowed

If you saw security promises that the product or testing could not support, talk with our whistleblower experts about the government purchases behind them. We build your case with you and bring in cybersecurity whistleblower lawyers who understand federal purchasing and product-security evidence. We stay beside you as technical knowledge becomes a case for recovering government money.