FDA issues a cybersecurity warning: DNA sequencing software is vulnerable to attacks
The U.S. Food and Drug Administration (FDA) has issued a warning to healthcare providers and laboratories of a cybersecurity vulnerability for DNA sequencing software that could impact patient data.
The warning is issued for software in the Illumina NextSeq 550Dx, the MiSeqDx, the NextSeq 500, NextSeq 550, MiSeq, iSeq, and MiniSeq next generation sequencing instruments. The medical devices are used either for clinical diagnostic use in sequencing a person’s DNA or testing for various genetic conditions, or for research use only (RUO). Some of the devices allow for either clinical diagnostic mode or RUO mode.
The cybersecurity vulnerability affects the Local Run Manager (LRM) software. There have not been any reports of a cybersecurity threat, but the vulnerability could allow an unauthorized user to take control of the instrument remotely, alter settings on the systems and even impact patient test results, according to the FDA.
Illumina has issued a software patch to fix the problem, and the company is working to provide a permanent software fix for current and future instruments. California-based Illumina is one of the biggest DNA sequencing companies. The company originally alerted clients to the cybersecurity vulnerability May 3, instructing them to check their instruments and medical devices for signs of potential exploitation.
“Illumina takes data privacy and cybersecurity very seriously and prioritizes instrument security and the protection of genomic and personal data,” a spokesperson said.
Healthcare providers are urged to immediately download the Illumina software patch and contact the company if any suspected tampering has occurred, as well as alert the FDA.
“The FDA wants laboratory personnel and healthcare providers to be aware of the required actions to mitigate these cybersecurity risks,” the FDA stated in its notice.