Genomic infrastructure security, 2023–2026: what the public record shows

This post collects what has been published about the security of genomic infrastructure between 2023 and October 2026: government advisories, NVD records, breach notices, regulator actions and new rules, gathered on 16 October 2026. None of the vulnerabilities or incidents is ThreatFight’s own finding; the CVE counts and the readings we mark as ours are our analysis of the public record. Each item links to a source. Where we relied on news or law-firm summaries, or where sources disagree, we say so.

Instruments: advisories against sequencers and genetic analyzers

Illumina Universal Copy Service, April 2023. CISA advisory ICSMA-23-117-01 covers two flaws in a service shipped on the iSeq 100, MiniSeq, MiSeq and MiSeqDx, NextSeq 500/550/550Dx, NextSeq 1000/2000, NovaSeq 6000 and iScan. CVE-2023-1968 (binding to an unrestricted IP address, CWE-1327) is network-reachable without authentication. CISA scored it CVSS v3 10.0; NVD’s base score is 7.5. CVE-2023-1966 (execution with unnecessary privileges, CWE-250) requires physical access in CISA’s vector, and CISA scored it 7.4; NVD’s base score is 9.8. The two scorers disagree in opposite directions on the pair. Illumina reported both to CISA itself.

Illumina DRAGEN server BMCs, 2024–2025. Illumina’s BMC support page lists two field safety notices for the baseboard management controller in DRAGEN Server v4 and the DRAGEN servers sold with the NovaSeq 6000Dx and NextSeq 550Dx: FSN2024-1635 (September 2024, a BMC user-account vulnerability) and FSN2025-1682 (January 2025, BMC remote network management, which requires an upgrade from CentOS 7 to Oracle 8 first). Illumina’s page lists no CVE for either. FDA recorded the correction as Class II recall Z-0068-2027, initiated 17 September 2024 and posted 1 October 2026; it cites both notices and covers 80 Dx-configured servers.

Illumina iSeq 100 firmware, January 2025. Eclypsium examined the iSeq 100’s OEM motherboard and found a BIOS dated 12 April 2018 running in CSM mode, with no Secure Boot and no firmware write protection. BleepingComputer reports the device was also exposed to LogoFAIL, Spectre v2 and MDS; Eclypsium’s text does not name them. The post assigns no CVEs. Illumina told The Register its “initial evaluation indicates these issues are not high-risk.” Some coverage counted “nine vulnerabilities”; that count is not in Eclypsium’s post.

Oxford Nanopore MinKNOW, October 2025. ICSMA-25-294-01 lists three CVEs in MinKNOW versions before 24.06 and 24.11: CVE-2024-35585 (CVSS 8.6, CWE-306), where remote access was on by default and authenticated by source IP; CVE-2025-54808 (7.8, CWE-522), a token stored in /tmp; and CVE-2025-10937 (5.5, CWE-754). The reporters are a University of Florida group (Rampazzi, Boucher, Stillman, Bravo); see arXiv:2407.12001. The CVE record for CVE-2024-35585, reserved in May 2024, was not published until 2 September 2026, more than ten months after the advisory, and NVD has not scored it.

Thermo Fisher Ion Torrent, December 2025 and May 2026. NVD lists six CVEs published 4 December 2025 for the Ion Torrent OneTouch 2 and Torrent Suite 5.18.1, including a default root password over SSH (CVE-2025-53963, 9.8), X11 exposed on all interfaces (CVE-2025-54304, 9.8), default credentials (CVE-2025-54303, 9.8) and a ZIP upload path traversal (CVE-2025-54307, 8.8). NVD notes the OneTouch 2 is out of support. The records name no finder, and we found no CISA advisory. A further CVE for Torrent Suite Dx 5.14.2 and earlier, CVE-2026-41085 (8.8, CWE-269), followed on 18 May 2026, also without a named finder.

Thermo Fisher Applied Biosystems genetic analyzers, August 2026. ICSMA-26-216-01 covers data collection software for the 3500, 3730, 3130, 310 and SeqStudio capillary electrophoresis instruments, and GeneMapper ID-X. CVE-2026-17583 (CVSS 8.4 v3.1, 8.2 v4; CWE-353, missing support for integrity check) means .fsa and .hid result files can be edited. The impact is on integrity: CISA says tampered files can produce inaccurate DNA test results, and GeneMapper ID-X is human-identification software. Adams, Gaydosh-Combs and Dyer are credited. It is the first CISA genetics advisory we found that is about tampering rather than access.

We found no advisories for MGI/Complete Genomics, PacBio, Element, Ultima or the Illumina NovaSeq X. That is an absence of data, not evidence those platforms are sound.

Software: what NVD shows for bioinformatics

We queried the NVD API 2.0 by keyword and CPE for more than two dozen tool, vendor and topic terms, then removed false matches by hand. The curated set is 52 CVEs from 2017 to 2026: 16 in 2026, 10 in 2025, 4 in 2024, 5 in 2023 and 17 across 2017–2022. By product: htslib 16, Thermo Fisher instruments and software 8, Galaxy 6, VCFtools 4, MinKNOW 3, samtools 2, BWA 2, Illumina UCS 2, plus single CVEs in htsjdk, Biopython, Nextflow, SequenceServer, IDseq, NVIDIA Clara Genomics, jcvi, cBioPortal and GPMAW.

Keyword search misses CVEs whose descriptions don’t name the product, so these counts are lower bounds. htslib’s GitHub security advisories added seven more with release 1.24 on 9 July 2026, carrying CVE-2026-62255 to -62260 and CVE-2026-63390. As of 23 October 2026 those IDs are still reserved at CVE.org and absent from NVD. Counting them, htslib has at least 23 CVE IDs.

Parsers are being audited heavily. On 18 March 2026 alone, NVD published 12 CVEs for htslib and samtools, mostly memory-safety bugs in the CRAM decoder (CWE-121, -122, -125, -416, -476). The htslib NEWS file entry for 1.23.1, which fixed the March CVEs, credits only Harrison Green (CVE-2026-31970), and the March advisories name no finder. The 1.24 entry ties the July advisories to “Trail of Bits and Anthropic” (CVE-2026-62257), Team Atlanta, a DARPA AI Cyber Challenge team (CVE-2026-62259, -62260), “Claude and Ada Logics” (CVE-2026-62258) and VulnSeeker Security Research (CVE-2026-63390), alongside OSS-Fuzz issues and individual researchers. Release 1.24 removed experimental CRAM v4.0 code “to reduce the likelihood of security issues” and added contribution guidelines with an AI policy. htslib has been in OSS-Fuzz since October 2019. Samtools, bcftools, BWA and Biopython have no OSS-Fuzz projects of their own; samtools and bcftools benefit indirectly because they share htslib’s parsers.

Workflow engines have barely been examined. NVD has one CVE for Nextflow (CVE-2026-48722, 5.5, CWE-276, September 2026) and none for Snakemake or Cromwell. Galaxy, a web platform as much as a workflow engine, has six (seven if a 2023 CVE in a Galaxy data-resource fork is counted), most of them published through GitHub security advisories. These engines can pull code and containers at run time and execute them with the permissions of whoever launched the pipeline. Our reading, a judgment rather than a measurement, is that the low counts reflect little scrutiny, not few bugs.

Data holders: breaches and a sale

23andMe, 2023. Attackers used credential stuffing, with passwords reused from other breaches, and the relatives-matching feature widened what each compromised account exposed. The company disclosed the incident in an October 2023 Form 8-K. The UK ICO penalty notice puts the access window at April to September 2023 and counts 155,592 affected UK residents. 23andMe’s December 2023 8-K/A put direct access at 0.1% of user accounts, widely reported as about 14,000; state attorneys general put the people affected at 6.9 million. The ICO fined 23andMe £2.31 million under UK GDPR Articles 5(1)(f) and 32(1). The notice is dated 5 June 2025 and the fine was announced on 17 June. The provisional figure was £4.59 million; the ICO cited 23andMe’s financial position, including the Chapter 11 filing, in reducing it.

In the U.S., the company’s FY2025 10-K records $37.5 million in class-action, arbitration and California settlements. The bankruptcy court gave the U.S. class settlement final approval on 30 January 2026 (class counsel), and state attorneys general describe it as a $46.75 million settlement. On 14 July 2026, 42 attorneys general (41 states and DC) announced an $18 million settlement with the bankruptcy trustee, which required bankruptcy-court approval; we have not confirmed that approval.

23andMe’s sale, 2025. The company filed for Chapter 11 on 23 March 2025. Regeneron won the May auction at $256 million, according to the 10-K. TTAM Research Institute, a nonprofit led by co-founder Anne Wojcicki, then bid $305 million, which the court approved in late June (as reported). TTAM announced the close on 14 July 2025. Twenty-seven states and DC went to court in the bankruptcy case to stop genetic data being sold without consent (Pennsylvania AG, describing a coalition of 28 attorneys general; press summary). We did not obtain the sale order, so we have not verified the privacy conditions attached to the transfer.

Baylor Genetics, 2026. The Houston clinical genomics lab’s notice and its Massachusetts AG filing describe unauthorized network access between 11 and 17 June 2026, detected on 15 June, with notifications from 14 August. Exposed data included names, dates of birth and test results, plus Social Security numbers for a “very limited subset” of patients and identifiers for some employees. The HHS breach portal lists 2,810,878 individuals, reported on 14 August 2026 as a hacking incident involving a network server. A proposed class action was filed on 8 October 2026 in the Southern District of Texas (case summary; we have not seen the docket). We found no public claim by any actor as of mid-October 2026.

UK Biobank, 2026. De-identified data exported by researchers at Chinese hospitals with approved access was listed for sale on Alibaba’s Xianyu marketplace; the minister said at least one of three listed datasets appeared to cover all 500,000 participants, and UK Biobank believes none was sold. Alibaba removed the listings, UK Biobank banned the institutions involved and, at the government’s request, suspended its research platform, and it referred itself to the ICO. A ministerial statement followed on 23 April, and an oversight committee report in June. Separately, the Guardian reported Biobank-derived datasets exposed on GitHub dozens of times, with 80 takedown notices issued between July and December 2025 (secondary summary). None of the published accounts describes an intrusion into UK Biobank’s systems: the data left through approved researcher access. Our reading is that this was a failure of data governance and contracts; the oversight report calls it “a serious breach of UK Biobank’s Material Transfer Agreement”. As of 23 October 2026 the platform had not reopened: UK Biobank’s 18 September update said phased access would not start before October, and its re-opening FAQ still describes a planned phased re-opening.

Policy

DOJ Data Security Program. Under Executive Order 14117, the Justice Department’s final rule, 28 CFR Part 202, was published on 8 January 2025 and took effect on 8 April 2025. It prohibits data-brokerage transactions with countries of concern and covered persons, and any covered data transaction that gives them access to bulk human ‘omic data or to human biospecimens from which such data could be derived (§ 202.303). Other vendor, employment and investment agreements are restricted rather than prohibited: they are allowed only if CISA’s security requirements are met. Any such agreement that gives access to bulk ‘omic data or biospecimens remains prohibited (§ 202.401(b)). Bulk starts at more than 100 U.S. persons for human genomic data, more than 1,000 for other human ‘omic data and for biometric identifiers, and more than 10,000 for personal health data. The rule text delays the due-diligence and audit requirements (subpart J) and two reporting requirements (§§ 202.1103 and 202.1104) to 6 October 2025; general record-keeping (§ 202.1101) was not delayed.

BIOSECURE. Enacted on 18 December 2025 as Section 851 of the FY2026 NDAA (Public Law 119-60). Section 851 names no companies. It covers biotechnology firms on the Defense Department’s 1260H list and firms OMB designates against set criteria, and requires OMB to publish its list within one year of enactment, by 18 December 2026. Law-firm summaries (Akin, Baker McKenzie) read it the same way.

Texas HB 130. The Texas Genomic Act passed on 23 May 2025. According to a policy summary, it bars covered Texas labs from using sequencers or software from foreign-adversary entities, bars storing Texas residents’ genomic data in adversary countries, and bars selling or transferring that data to adversary-linked buyers in a bankruptcy or Chapter 11 reorganization. The enrolled text matches that summary. The governor signed it on 20 June 2025 and it took effect on 1 September 2025 (bill history).

FDA section 524B and NIST. Premarket cybersecurity requirements for networked medical devices have applied since 29 March 2023 (FDA), and FDA updated its guidance in June 2025 (report). None of the sources we read confirms how 524B applies to particular sequencers. NIST IR 8432, Cybersecurity of Genomic Data, was finalized on 20 December 2023.

What the record shows, and what it doesn’t

• Few people report instrument flaws. The credited reporters are a vendor reporting on itself (Illumina), one firmware security company (Eclypsium), one university group (Florida) and three named researchers (the ABI advisory). Seven Thermo Fisher CVEs name no finder at all.
• Integrity flaws are now on record. The Applied Biosystems advisory concerns altered results, not stolen data. Breach-notification regimes are built around confidentiality and say little about results that were quietly changed.
• Effort is uneven. htslib’s parsers are being fuzzed and audited, including by AI-assisted teams, and htslib and samtools have 12 published CVEs in 2026, plus seven reserved IDs in htslib’s July advisories. Nextflow, Snakemake and Cromwell, which run code fetched at run time, have one CVE between them in NVD; Galaxy, a web platform, has six.
• The attack techniques were ordinary. 23andMe was credential stuffing, Baylor Genetics a network intrusion, and UK Biobank, in our reading, a governance failure. None of the published accounts describes an intrusion technique specific to genomics. What made them serious was the data, and at 23andMe a genomics feature: relatives matching multiplied what each compromised account exposed, from about 14,000 accounts to about 6.9 million people.
• Policy is moving faster than testing. 28 CFR 202 governs who may access bulk U.S. genomic data. Texas HB 130, per the policy summary above, reaches the sequencers and software covered Texas labs may use. BIOSECURE’s list of biotechnology companies of concern is due by 18 December 2026. Public, independent security testing of the equipment itself is still rare.

Known gaps: we did not enumerate Illumina’s full bulletin archive, and found nothing on several major sequencing platforms. Corrections and additions with sources are welcome at [email protected].