FDA issues a cybersecurity warning: DNA sequencing software is vulnerable to attacks

The U.S. Food and Drug Administration (FDA) has issued a warning to healthcare providers and laboratories of a cybersecurity vulnerability for DNA sequencing software that could impact patient data.

The warning is issued for software in the Illumina NextSeq 550Dx, the MiSeqDx, the NextSeq 500, NextSeq 550, MiSeq, iSeq, and MiniSeq next generation sequencing instruments. The medical devices are used either for clinical diagnostic use in sequencing a person’s DNA or testing for various genetic conditions, or for research use only (RUO). Some of the devices allow for either clinical diagnostic mode or RUO mode.

The cybersecurity vulnerability affects the Local Run Manager (LRM) software. There have not been any reports of a cybersecurity threat, but the vulnerability could allow an unauthorized user to take control of the instrument remotely, alter settings on the systems and even impact patient test results, according to the FDA.

Illumina has issued a software patch to fix the problem, and the company is working to provide a permanent software fix for current and future instruments. California-based Illumina is one of the biggest DNA sequencing companies. The company originally alerted clients to the cybersecurity vulnerability May 3, instructing them to check their instruments and medical devices for signs of potential exploitation.

“Illumina takes data privacy and cybersecurity very seriously and prioritizes instrument security and the protection of genomic and personal data,” a spokesperson said.

Healthcare providers are urged to immediately download the Illumina software patch and contact the company if any suspected tampering has occurred, as well as alert the FDA.

“The FDA wants laboratory personnel and healthcare providers to be aware of the required actions to mitigate these cybersecurity risks,” the FDA stated in its notice.

Amy Baxter

Amy joined TriMed Media as a Senior Writer for HealthExec after covering home care for three years. When not writing about all things healthcare, she fulfills her lifelong dream of becoming a pirate by sailing in regattas and enjoying rum. Fun fact: she sailed 333 miles across Lake Michigan in the Chicago Yacht Club "Race to Mackinac."

Around the web

The tirzepatide shortage that first began in 2022 has been resolved. Drug companies distributing compounded versions of the popular drug now have two to three more months to distribute their remaining supply.

The 24 members of the House Task Force on AI—12 reps from each party—have posted a 253-page report detailing their bipartisan vision for encouraging innovation while minimizing risks. 

Merck sent Hansoh Pharma, a Chinese biopharmaceutical company, an upfront payment of $112 million to license a new investigational GLP-1 receptor agonist. There could be many more payments to come if certain milestones are met.