Cybersecurity Policy Report, SETTLEMENT AGREEMENTS: Genomic sequencing corporation settles with Justice Department over False Claims Act violations, (Aug 5, 2025)

By Molly Platnick

The company agreed to pay $9.8 million to resolve allegations it sold genomic sequencing systems with cybersecurity vulnerabilities to federal agencies.

Illumina, Inc’s former Director for Platform Management filed a qui tam action alleging the corporation submitted false claims regarding its software to various federal agencies. The case was filed under the False Claims Act (FCA) whistleblower provision, which allows a private party to sue on behalf of the government and receive a share of any recovery. The Justice Department collaborated on this case with the Army Criminal Investigation Division, HHS Office of the Inspector General, Department of Commerce, and U.S. Attorney’s Office for Rhode Island (Settlement Agreement, United States ex. rel. Lenore v. Illumina Inc., No. 1:23-cv-00372 (D.R.I. July 21, 2025)).

Illumina, which is headquartered in California, sold genomic sequencing systems to the federal government between February 2016 and September 2023.

The United States contended the sales were based on false claims about the systems’ cybersecurity and stated the corporation had “knowingly failed to incorporate cybersecurity in its software design” and “falsely represented…that the software on the Genomic Sequencing Systems adhered to cyber security standards.” The Justice Department sued on behalf of the Smithsonian Institution, Defense Logistics Agency, and departments of Health and Human Services, Veterans Affairs, National Aeronautics and Space Administration, Army, Navy, and Air Force, Commerce, Homeland Security, Energy, and the Interior, all of which had purchased the corporation’s software.

The terms of the settlement require the genomic sequencing corporation to pay the federal government $9.8 million with interest $4.3 million of the settlement amount is restitution and must be paid within 10 days of the settlement. After receiving the full settlement amount, the United States will transfer $1.9 million to the corporation’s former director who initially filed the suit. The corporation and former director entered into another agreement based on a separate civil action. The corporation denied the allegations regarding its software for purposes of the civil action, and the settlement stipulates it is not an admission of liability.

Quoted in the Justice Department’s press release, Assistant Attorney General Brett Shumate hailed the settlement as a “[underscoring] the importance of cybersecurity in handling genetic information and the Department’s commitment to ensuring that federal contractors adhere to requirements to protect sensitive information from cyber threats.” The assistant A.G. suggested the outcome of this case should be a warning that “companies that sell products to the federal government will be held accountable for failing to adhere to cybersecurity standards and protecting against cybersecurity risks.”

CIAsSettlementAgreements: SettlementAgreementsNews CMSNews CyberPrivacyFeed Enforcement FCANews FraudNews DataPrivacy DataSecurity