Evidence: officially disclosed. Imported from the supplied 65-Case Master Edition, dated September 19, 2026. Source links and classifications are retained as an attributed case account; import is not an independent source review.

Case at a glance

Case number
045
Date / range
2022 disclosure
Sector
Genomic cybersecurity and infrastructure
Genetic asset
Sequencing instrument software and workflow files
Security principle
Instrument Software Is Part of the Genome

Event summary

Critical vulnerabilities disclosed in Illumina Local Run Manager showed that sequencing instruments can inherit ordinary web, authentication, and file-handling weaknesses with extraordinary consequences for genomic confidentiality and result integrity.

Source: cisa.gov — Illumina Local Run Manager Vulnerabilities source 1.

Source: support.illumina.com — Illumina Local Run Manager Vulnerabilities source 2.

The case in context

The Local Run Manager advisory brought instrument software into the same security discussion as the genomic data it processes. A sequencing instrument is also a networked computing system, with software, identities, and file-handling behavior that can create access paths.

An advisory establishes a vulnerability, not evidence that someone exploited it or changed a patient's result. The practical response is to identify affected versions and follow the vendor's remediation for the actual environment. If a compromise is suspected, the trustworthiness of affected outputs becomes a separate question from whether the instrument is running again.

Acquisition and processing

reachable instrument software → authentication/path-handling flaw → unauthorized access or modification → sequencing data/result risk → clinical/research consequence

The sequence of events

  1. reachable instrument software
  2. authentication/path-handling flaw
  3. unauthorized access or modification
  4. sequencing data/result risk
  5. clinical/research consequence

What became inferable or exposed

Sequencing instrument software and workflow files

Critical vulnerabilities disclosed in Illumina Local Run Manager showed that sequencing instruments can inherit ordinary web, authentication, and file-handling weaknesses with extraordinary consequences for genomic confidentiality and result integrity.

Security dimensions

Confidentiality

The confidentiality question concerns sequencing instrument software and workflow files. Exposure and further inference must be distinguished from the fact of collection or availability.

Integrity

The integrity question is whether the described material, permissions, processing, or interpretation can be relied upon. Instrument Software Is Part of the Genome identifies the particular boundary examined here.

Availability

Access and continuity are assessed for the described event; potential effects are not presented as confirmed outages or losses.

Provenance

The relevant chain follows sequencing instrument software and workflow files through the stages shown below. Missing public detail is not proof that internal records did not exist.

GeneticSecurity.org analysis

Genetic Exposure Radius

Not assessed

No single level is assigned where the supplied dossier gives a range, conditional outcome, or broad institutional consequence. The affected parties and proposed assessment are shown separately.

Confidence: not assigned. Classification: GeneticSecurity.org analysis.

Genetic Persistence Risk

Not assessed

Persistence depends on the specific biological material or information retained. A potential effect is not treated as an observed genomic disclosure.

Confidence: not assigned. Classification: GeneticSecurity.org analysis.

Genetic Provenance Integrity

Not assessed

A numeric provenance level is not inferred from the existence of a source or court record. It requires evidence of the relevant custody and processing controls.

Confidence: not assigned. Classification: GeneticSecurity.org analysis.

Proposed classification and its limits

Suggested GER: depends on instrument workload, potentially GER-3/4. Suggested GPR: GPR-5 if whole genomes exposed. Suggested GPI: GPI-0/1 after unbounded compromise until revalidated.

These are proposed classifications from the supplied case dossier. Conditional scores describe an assumed exposure; they are not evidence that it occurred. A single numeric value is left unassigned when the asset or outcome is not sufficiently bounded.

What this case does not prove

A vulnerability is not proof of exploitation, altered patient results, or data theft.

Mitigations and lessons

  • Network segmentation
  • No direct internet exposure
  • Vendor patching
  • MFA where supported
  • Allowlisting
  • Signed updates
  • Backup/restore testing
  • Post-compromise result revalidation

Primary sources

Secondary sources

No additional source listed. See the evidence notes for limitations.

Policy and standards

Genetic Security Policy and Standards

Review and correction history

Source edition: September 19, 2026. Imported case account; no substantive corrections recorded.

Correction policy and log

Cite this case

GS-CASE-045. Local Run Manager: The Sequencer Was Also a Networked Computer. GeneticSecurity.org. https://geneticsecurity.org/cases/045-illumina-local-run-manager-vulnerabilities/