The breach you did not have

Software supply-chain and third-party cyber risk for pharmaceuticals and life-sciences organisations in Illinois, United States.

Most cyber-security budgets are built to stop an attacker at the edge of the network. That is where the money goes: the firewall, multi-factor authentication, vendor questionnaires, and a software bill of materials listing every open-source component in the estate with a signature to prove each one is genuine.

That is not how 2026 went. The year's cyber-intrusions in pharmaceuticals and life sciences came in through a supplier, through an integration someone authorised years ago and forgot, and through ordinary software packages that arrived looking perfectly normal. In each case the perimeter held. It was simply not where the attack happened.

One August incident involved a package that carried a valid signature. Microsoft Threat Intelligence reported a self-propagating worm in the npm registry, a public software library. It did not defeat the system built to prove where a package came from. Packages published through a legitimate build workflow carried valid provenance. The green tick did not fail to appear. It appeared, and the code behind it was malicious.

That is the shape of the problem. An organisation's cyber-security now depends on other people's hygiene: a supplier's help desk, a vendor's stored credentials, a software maintainer's account. Its liability does not move. It stays with whoever holds the data. Illinois's biometric statute gives individuals a private right of action (740 ILCS 14/20), so in Illinois the people whose data leaked can bring the claim themselves.

Five risks, ranked by how badly they bite

1. A biometric class action arriving on the back of someone else's breach. Illinois's Biometric Information Privacy Act covers fingerprints, voiceprints and face or hand scans, and gives individuals a private right of action for $1,000 per negligent violation and $5,000 per intentional or reckless one, plus legal fees, without having to show they were harmed (740 ILCS 14/20). A fingerprint clock in a warehouse, or a face scan on a clean-room door, is a class action waiting for an incident to reveal it, and it attaches to the organisation even when the failure was a supplier's.

2. Bulk theft from a customer database and data warehouse. The signature event of the year, and the one with the fastest legal tail. Attackers talk their way into someone's login rather than breaking anything, then use the connected cloud systems to export data in bulk. The records here are the regulated kind, so the Illinois notification duty starts at once.

3. Validated manufacturing brought to a halt. Third only because it happens less often, not because it costs less. A drug maker cannot wipe its servers and restart the line: every process must be revalidated and every change documented before production can lawfully resume. That turns an outage a retailer measures in days into one measured in weeks.

4. A supplier's breach that becomes the data owner's notification. When a vendor holding a customer's records is compromised, the people affected are the customer's patients, not the vendor's. Under Illinois law the duty to tell them falls on whoever owns the records (815 ILCS 530/10). The data owner's notification deadline runs independently of the vendor's investigation.

5. A poisoned software package in the build pipeline. Lower for organisations that write no code of their own. But it is the top risk for any organisation running bioinformatics, clinical pipelines or patient-facing apps, and writing no code does not remove it, because suppliers write plenty.

Three companies, two material-incident filings

The clearest way to see this is to read what companies filed about themselves this year.

West Pharmaceutical Services detected an intrusion on 4 May and determined by 7 May that the incident was material, filing under Item 1.05 of Form 8-K, the item reserved for material cyber-security incidents, within days of detection. Data was exfiltrated, systems were encrypted and operations were taken offline globally. By 20 May, in an amended filing, it reported that shipping, receiving and manufacturing had restarted.

Boston Scientific identified an incident on 25 August and reported it the next day under Item 8.01, stating that it had not yet determined whether the incident was reasonably likely to have a material impact. On 8 September it filed under Item 1.05, stating that the incident was likely to have a material impact on its results of operations and had affected its ability to manufacture and to process and ship customer orders.

On 28 August 2026 McKesson reported, in a voluntary Regulation FD filing, that it had discovered a cyber-security incident affecting its information systems on 25 August, that its investigation was at an early stage, and that it had not determined the incident to be material.

Two of the three companies ultimately filed under the material-incident rule, at different points after detection: West within days, having determined materiality three days after detection, and Boston Scientific fourteen days after it identified the incident. The four-business-day disclosure clock does not start when a company discovers an incident. It starts when the company determines the incident is material. The rule requires that determination to be made without unreasonable delay.

Five routes in, and where the Illinois consequence lands

Route in	Evidence or authority	Illinois consequence	First 24-hour decision
Voice-phishing into single sign-on	FBI advisory IC3 CSA 250912, September 2025	AG notice above 500 residents (815 ILCS 530/10(e)); Consumer Fraud Act	Revoke sessions and tokens; assess materiality
Stolen OAuth token in a connected app	FBI advisory IC3 CSA 250912: compromised OAuth tokens, August 2025	Notification sits with the data owner, not the vendor	Revoke tokens; scope the data reached
Poisoned open-source dependency	Microsoft: npm worm, more than 400 packages, August 2026	Biometric Act exposure where identifiers are touched	Freeze pipelines; rotate build credentials
Intrusion into validated manufacturing	West Pharmaceutical and Boston Scientific 8-K filings, 2026	Notification plus contractual and continuity loss	Segment plant networks; keep safety running
A software vendor's own breach	815 ILCS 530/10(b): a data holder that does not own the data must notify the owner	AG threshold follows the data owner	Get vendor scope; decide independent notice

Note. Five routes in. None starts inside the data owner's own code, and in each the Illinois consequence lands on the data owner.

The signature that was valid

The signed package mentioned at the start of this piece is worth following properly, because it undoes a control a great many organisations rely on. Microsoft Threat Intelligence reported on 4 August 2026 a self-propagating worm in the npm registry affecting more than 400 packages, which runs through a preinstall hook and targets npm, GitHub and cloud credentials.

The npm registry is the public library that software projects pull ready-made components from, so that nobody has to write everything from scratch. A preinstall hook is a script that runs automatically when a developer installs a package, before any of the package's code is used.

A software bill of materials is what most organisations point to when asked how they handle this: an inventory of every third-party component, checked against signatures proving each came from the build process it claims. The idea is sound and the tools are real. The problem is a step nobody examined. A signature proves where code came from. Buyers had quietly started reading it as proof the code is safe. Those are not the same claim.

The worm made the point. Packages published through a legitimate build workflow carried valid provenance: new proof-of-origin records, genuine in every respect, attached to code that was malicious.

So how does a problem in a public software library reach a drug company in Illinois? By two routes, and neither requires that company to think of itself as a software business. The first is that life-sciences firms write more software than they realise: bioinformatics and clinical-trial pipelines, laboratory systems, patient-facing apps and the integrations holding them together are mostly assembled from these same public components.

And what this worm targeted was credentials. Developer credentials open a path into clinical, manufacturing and patient systems, which is how a problem in a build pipeline becomes a reportable breach of patient data.

The second route is simpler. Suppliers write software too. The billing platform, the electronic-records system, the laboratory package: each is built the same way, from the same libraries, and the customer inherits whatever its makers pulled in. A compromised component does not announce itself, and the first sign is usually a credential being used somewhere it has no business being.

The same lesson arrives from a third direction. In an advisory issued in September 2025 (IC3 CSA 250912), the FBI described a group it tracks as UNC6395 using compromised OAuth tokens for a third-party sales-chat application in August 2025 to reach data in connected customer systems. Such a token is standing permission for one application to read another on an organisation's behalf, and it was never a password. An OAuth token remains valid after a password change until it is revoked.

Why Illinois makes everything worse

On breach notification alone, Illinois is conventional. Its Personal Information Protection Act requires notice to affected residents without unreasonable delay, and to the Attorney General when one breach means notifying more than 500 of them (815 ILCS 530/10(e)). A violation is an unlawful practice under the Consumer Fraud Act, which allows civil penalties of up to $50,000 per violation (815 ILCS 505/7).

The Biometric Information Privacy Act changes the arithmetic. Illinois's BIPA gives individuals a private right of action (740 ILCS 14/20). Texas has a biometric law too, but only its Attorney General can enforce it (Tex. Bus. & Com. Code 503.001). In Illinois the people whose data leaked bring the case themselves, and they do not have to show they were harmed.

Two changes have brought the numbers down without removing the exposure. In August 2024 the legislature provided that repeated collection of the same person's biometric identifier by the same method counts as one violation, not many (Public Act 103-769). In April 2026 the Seventh Circuit, in Clay v. Union Pacific Railroad Co., held that the amendment applies to cases already pending. Liability is now one recovery per person, which across a large workforce still reaches millions.

Note. All three are final settlements. The BNSF figure followed a $228 million jury award in Rogers v. BNSF Railway that was set aside, with damages ordered to be heard again.

Three regulators, one incident

The regulators do not queue up politely. They arrive together. Federal health-privacy penalties are tiered by culpability, but each affected record can count as its own violation, so a single event exposing weak risk analysis, late notification and loose access control opens three penalty tracks at once.

State attorneys general add a front that federal ceilings do not cap, and for listed companies the securities regulator adds a third, with its four-business-day clock running from the materiality determination. As the three filings above show, that determination can come days or weeks after detection.

Federal health-privacy civil penalties, assessed on or after 28 January 2026

Tier (culpability)	Per-violation range	Annual cap applied
Tier 1: no knowledge	$145 to $73,011	$36,505.50
Tier 2: reasonable cause	$1,461 to $73,011	$146,053
Tier 3: wilful neglect, corrected	$14,602 to $73,011	$365,052
Tier 4: wilful neglect, not corrected	$73,011 to $2,190,294	$2,190,294

Note. Each affected record can count as its own violation. One incident can open three of these tracks at once, each with its own annual cap.

The private bill is the bigger one

Private lawsuits move faster than regulators, and they have been growing. The Duane Morris Class Action Review reports that the ten largest American data-breach class action settlements totalled $515.75 million in 2023 and $593.2 million in 2024.

Settlement exposure scales with the number of people notified, not only with the handful who can prove damage.

The layer most boards treat as their backstop is thinner than it looks. Losses from an employee talked into approving access are often capped far below the headline limit, claims can be refused when the cyber-security controls described at renewal cannot be evidenced afterwards, and many policies exclude regulatory fines outright.

Why recovery takes weeks, not days

One thing sets this sector apart. A regulated manufacturer cannot restore from backup and start the line again: every process must be revalidated and every change documented first. That is a quality obligation, not a technical one, so the recovery clock is not set by the organisation's cyber-security team and cannot be shortened by it.

It lands on an industry under sustained attack. Check Point Research reported that in 2025 manufacturers faced an average of 1,585 cyber-attacks per organisation each week, 30 per cent more than a year earlier. So the factory floor is a standing weakness, and a recovery plan built to an ordinary disaster-recovery timetable is wrong before it is tested.

The warning signs come early and cost little to watch

The useful signals sit in the identity and vendor layers. They come early and cheap; the financial and legal ones come late and only confirm damage already done.

Inside an organisation's own systems the signs are specific. A connected application nobody remembers approving. Logins from unfamiliar countries. Repeated multi-factor prompts. Large exports from the customer database outside working hours. In the build pipeline, packages that reach out to the internet while installing. Outside, a supplier that reports an incident or cannot quickly say whether it uses the platforms currently being attacked.

The signal most often thrown away is human. Attackers get in by talking to people, so a rise in calls impersonating the IT team carries information, especially where the caller knew real names or project details. The FBI advisory identifies calls impersonating IT support as the initial access method.

Escalation is the other half. Five triggers recur: data suspected to have left rather than merely been seen, a supplier or cloud platform involved, a live disclosure obligation, more than 500 Illinois residents possibly affected, or an extortion demand. Each trigger is a point at which incident-response work typically moves to external specialists.

Which specialist, for which trigger

Trigger	Right expert	What they do that in-house cannot
Single sign-on or OAuth-token compromise	Cloud and SaaS forensics	Scopes lateral movement across connected apps that internal logs miss
Malicious package in the build pipeline	Software supply-chain specialist	Detects subverted provenance: a poisoned package can ship correctly signed
Extortion or ransom demand	Ransom negotiation and sanctions screening	Manages negotiation, sanctions exposure and evidence preservation
Large volume of records to review	eDiscovery provider	Identifies affected individuals from the data, not from attacker claims
Listed-company disclosure	Securities counsel with privacy counsel	Judges materiality and timing for the four-business-day clock

What it comes down to

TheRiskAgent's briefing places cyber-security exposure for an Illinois pharmaceuticals or life-sciences business at the top of its scale and rising: an active worm in the open-source supply chain, social-engineering campaigns against connected cloud platforms, and a biometric statute that gives individuals a private right of action.

Go back to the gap the piece opened with, because everything here is a version of it. The things that broke belonged to other people: a supplier's help desk, a vendor's stored tokens, a maintainer's account. The consequences did not. The notification duty, the Attorney General threshold, the biometric claim and the weeks of revalidation all landed on whoever held the data.

Which leaves one question for any board in this sector. The controls that failed this year were not exotic or neglected. They were multi-factor authentication, attestations from large and reputable platforms, and signed software components: the three things most companies would name to prove they take cyber-security seriously. Each of the three was present in at least one of this year's incidents.

Drawn from TheRiskAgent's risk briefing on software supply-chain and third-party cyber risk for pharmaceuticals and life sciences in Illinois (September 2026). Figures checked against the issuing official sources in October 2026; company statements are taken from those companies' own SEC filings. Reference material, not advice.