Access Authorization Credential Authority Failure Through Elevated Default Privileges Granted to Standard Users — Illumina Inc., 2016–2023

Genomic sequencing systems process, store, and transmit genetic and patient health information — among the most sensitive categories of personal data subject to federal protection. Federal agencies that purchase these systems rely on the access authorization credential embedded in the product design: the system certifies, through its privilege architecture, that users can access only what their assigned role permits. When an agency purchases a sequencing system for use in federal health programs, the access credential is the mechanism through which the agency establishes that patient data is protected at the point of use.

Illumina sold genomic sequencing systems to federal agencies from February 2016 through September 2023. During that period, the systems granted everyday users administrative-level privileges by default. The relator — a former Illumina Director for Platform Management — described this as analogous to granting every user super-administrator rights over a database. Standard users could access and manipulate confidential patient health data, alter product configurations, install unauthorized applications, grant third parties access to the system, and disable firewalls — without detection. The privilege boundary the access credential was required to represent was not present in the system design. Illumina represented to federal agency customers that the software adhered to applicable cybersecurity standards including ISO and NIST. The representation was false.

A former Illumina Director for Platform Management filed a qui tam complaint in September 2023 alleging three concurrent cybersecurity failures: elevated default privileges, hard-coded credentials, and ungoverned insider access to customer data. DOJ investigated and settled on July 31, 2025 for $9.8 million — the first FCA settlement with a medical device manufacturer based on cybersecurity deficiencies in product design. The settlement established that no actual data breach was required for FCA liability. The false claims arose from the credential itself: Illumina represented its systems complied with cybersecurity standards while knowingly selling systems whose access authorization architecture did not enforce the privilege boundaries those standards required.

The seven-year duration of the failure — 2016 through 2023 — documents the gap between the credential representation and the access condition it was supposed to certify across the entire period of federal agency sales. The agencies that purchased and relied on these systems had no mechanism to evaluate whether the access authorization credential represented the privilege boundary it certified. The product was the credential. The credential certified a boundary. The boundary was absent from the design.

The access authorization credential in a software system is its privilege architecture — the design that encodes which users can access which data and functions. When a system grants administrative privileges to everyday users by default, the credential certifies a boundary that is not present. Every user who logs in receives access that exceeds what the credential is supposed to authorize. The boundary is not enforced at the point of access. It is not evaluable from the credential. The relying party — the federal agency and the patients whose data the system processes — cannot determine from the credential whether the access boundary the system represents is the access boundary the system enforces.

The three failure conditions in this case are structurally distinct but trace to the same absent encoding condition. Elevated default privileges: the access credential does not enforce the privilege boundary at the point of user authentication. Hard-coded credentials: the access credential is fixed in the system design — the authorized user cannot rotate, revoke, or control it. Ungoverned insider access: the access credential does not encode the boundary between Illumina personnel and customer patient data — the credential authorizes access without representing who is excluded from it.

In all three conditions, the access authorization credential certified a boundary condition that was not present in the system at the point of reliance. Federal agencies purchased the systems. The credential represented compliance. The compliance condition the credential certified was not encoded in the design. Seven years. Multiple federal agency customers. No breach required to establish that the claims were false.

The $9.8 million settlement resolved the FCA allegations without an admission of liability. The DOJ characterized the settlement as underscoring the importance of cybersecurity in handling genetic information and DOJ's commitment to holding federal contractors accountable for cybersecurity risks. The case establishes that FCA liability for access authorization credential failures in product design extends to the full period of federal agency sales — seven years — regardless of whether any breach occurred during that period.

The settlement does not resolve the architectural condition. Federal agencies purchasing software products rely on access authorization credentials embedded in product design whose compliance with required standards is represented by the vendor. The relying party cannot evaluate whether the privilege boundary the credential certifies is the privilege boundary the system enforces without independent verification of the product's access architecture at the point of purchase and at every point of subsequent use.

• The access authorization credential in Illumina's genomic sequencing systems certified compliance with cybersecurity standards requiring defined privilege boundaries; everyday users received administrative-level access by default — the equivalent of super-administrator rights over databases containing HIPAA-protected patient data; the privilege boundary the credential was required to represent was absent from the system design for seven years across multiple federal agency customers
• Three concurrent failure conditions document the same structural gap from different access vectors: elevated default privileges (boundary not enforced at authentication), hard-coded credentials (access point fixed in design, non-rotatable, not controlled by authorized user), and ungoverned insider access (boundary between vendor personnel and customer data not encoded in credential)
• Illumina represented to federal agency customers that the software adhered to applicable ISO and NIST cybersecurity standards; the representation was the access authorization credential; the access condition the credential certified was not present in the product design; federal agencies had no mechanism to evaluate whether the privilege boundary the credential represented was the privilege boundary the system enforced
• No data breach was alleged or required for FCA liability; the government contended the claims were false regardless of whether breaches occurred; the false claim was in the credential — the representation of compliance with access authorization standards — not in any documented harm; the credential authorized seven years of federal agency purchases on a compliance condition that was not present
• The seven-year failure period — 2016 through 2023 — documents the duration over which the access authorization credential certified a boundary condition absent from the product design; the gap between the credential representation and the access condition it was supposed to certify persisted across the entire period of federal agency sales without detection through normal agency oversight
• An access authorization credential that encodes the privilege boundary in a form evaluable at the point of purchase and at the point of use — independently verifiable without relying on the vendor's representation of compliance — makes the access condition demonstrable before the credential authorizes agency purchase and patient data exposure; a system whose privilege architecture does not enforce the boundary the credential certifies fails at the point of credential generation