The breach you did not have

Software supply-chain and third-party cyber risk for pharmaceuticals and life-sciences organisations in Illinois, United States.

Security budgets are built on a picture of the threat that is about a decade out of date. In that picture an attacker probes the edge of the network, finds a flaw, and forces a way in. So the money goes to the perimeter, to multi-factor authentication, to vendor questionnaires and attestations, and to a software bill of materials that lists every open-source component in the estate and proves each one is what it claims to be.

Almost none of the intrusions that defined 2026 for pharmaceuticals and life sciences went that way. A large drug distributor was reached through third-party applications. Hundreds of organisations had customer records exported through a marketing chatbot they had authorised years earlier and forgotten. A worm spread through more than four hundred open-source packages by running automatically the moment a developer installed one.

Then comes the detail that should unsettle anyone relying on the standard assurances. That worm did not evade the systems built to prove a package is genuine. It used them, generating fresh provenance records for the releases it had altered, and at least one compromised package shipped with a valid signature. The green tick did not fail to appear. It appeared, and it was wrong.

So the spine of the matter is an asymmetry. An organisation's security is now a function of other people's hygiene, of a supplier's help desk, a vendor's token store, a maintainer's account. Its liability is not shared out in the same way. It stays where the data sits. And Illinois is the most expensive place in the United States to discover that, because one state statute lets the people whose data leaked sue the organisation that lost it, without proving they were harmed at all.

Five risks, ranked by how badly they bite

The detail follows, but the bottom line comes first, worst first.

1. A biometric class action riding in on someone else's breach. The Biometric Information Privacy Act is what makes Illinois different in kind rather than degree. It governs fingerprints, voiceprints and face or hand scans, and it carries a private right of action with statutory damages of $1,000 for each negligent violation and $5,000 for each intentional or reckless one, plus the claimant's legal fees. The Illinois Supreme Court has held that a claimant need not prove actual harm. A fingerprint time clock in a distribution centre, or a facial scan on a clean-room door, is therefore not a minor access-control decision. It is a class-action exposure that can dwarf the incident that exposed it, and it attaches even when the failure was a supplier's.

2. Bulk theft from the customer database and the data warehouse. The signature event of 2026, and the one with the fastest legal tail. The pattern is consistent: attackers obtain single sign-on credentials by deception rather than by exploiting a flaw, then use the connected cloud platforms to export at scale. Because the stolen categories in this sector are the regulated ones, the Illinois clock starts immediately, and the plaintiffs' bar does not wait for forensic certainty. Solicitations have appeared within days of a disclosure, while the investigation was still at an early stage.

3. Validated manufacturing brought to a halt. Ranked third only because it is less common than data theft, not because it is cheaper. A drug maker cannot reimage its servers and restart the line. Every process must be revalidated and every system change documented before production lawfully resumes, which turns an outage that a retailer measures in days into one measured in weeks. When a medical device maker was attacked in August, it disclosed disruption to its ability to process and ship customer orders and said the timeline for full restoration was not yet known. In this sector the tail of an outage reaches the patient, not only the balance sheet.

4. A supplier's breach that becomes your notification. An Ohio software vendor's compromise exposed 3.8 million patients this year, the largest single report to federal regulators, and the patients belonged to its healthcare customers rather than to the vendor. Under Illinois law the duty to notify follows the data owner, not the party that failed. Waiting for a supplier's timeline is itself a route to a compliance failure, because the statute runs on a standard of no unreasonable delay rather than a fixed number of days.

5. A poisoned software package in the build pipeline. Genuinely lower for a distributor or contract manufacturer that writes no code of its own, and that honesty matters when budgets are set. But it is the highest-ranked risk for any organisation running bioinformatics, clinical data pipelines or patient-facing applications, and it is the only one here that defeats the assurance most buyers believe is settled.

A telephone call, not a firewall

The route that dominated the year begins with a voice. An attacker telephones a help desk or an operations team, impersonates internal technology staff, and talks someone into approving a login or a connected application. No flaw is exploited, because none needs to be. The FBI has issued an advisory on the resulting campaigns, and the health sector's threat-sharing body has spent the year warning members that social engineering aimed at corporate accounts is the way into the cloud platforms behind them.

Understand the mechanism precisely, because of what it does to a control most organisations trust. Single sign-on is the service that lets one login open every connected application, so compromising it does not open a door; it opens the corridor. The customer-relationship platform holds the customer, prescriber and payer records. The analytics warehouse is where they are aggregated. An attacker who reaches both has the commercial heart of the business.

And multi-factor authentication does not stop this. The control works exactly as designed. Someone is simply persuaded to use it on the attacker's behalf, which is a different problem from a bypassed control and is not solved by buying more of the same. It is solved by authentication that cannot be relayed by a caller on a telephone, and by breaking the help-desk workflow that lets a convincing voice obtain a credential reset without proving who it belongs to.

Five routes in, and where the Illinois consequence lands

Route in	2026 evidence	Illinois consequence	First 24-hour decision
Voice-phishing into single sign-on	FBI and Health-ISAC advisories, 2025 to 2026	Attorney General notice above 500 residents; Consumer Fraud Act	Revoke sessions and tokens; assess disclosure materiality
Stolen OAuth token in a connected app	Sales chatbot integration, 700-plus organisations	Notification duty sits with the data owner, not the vendor	Revoke integration tokens; scope the data it could reach
Poisoned open-source dependency	npm worm, 444 packages, August 2026	Biometric Act exposure where identifiers are touched	Freeze build pipelines; rotate build credentials
Intrusion into validated manufacturing	2026 SEC filings by listed manufacturers	Notification plus contractual and supply-continuity loss	Segment plant networks; keep safety processes running
A software vendor's own breach	Ohio vendor, 3.8 million patients	Attorney General threshold follows the data owner	Get precise vendor scope; decide independent notice duty

Note. Five routes in, none of which starts inside the organisation's own code. The Illinois consequence lands on the data owner in every one.

The signature that was forged

The second route should change how assurance is bought. In August 2026 Microsoft's threat researchers identified a self-propagating credential-stealing worm running through the npm registry, the public library from which JavaScript projects draw their building blocks. It reached at least 444 packages across 1,381 versions, together carrying more than two billion installations a month, and it executed automatically through an install hook, meaning the code ran simply because a developer typed a command to fetch a dependency.

A software bill of materials is the control most organisations point to when asked how they manage this. It is an inventory of every third-party component in a piece of software, checked against signatures proving each came from the build process it claims to. The reasoning is sound and the tooling is real. What the worm demonstrated is that the reasoning has an unexamined step in it: a signature proves origin, and buyers had quietly begun reading it as proof of safety. The worm generated new provenance records for the releases it had altered, and at least one compromised package shipped with a valid signature. A June compromise of a widely used build tool had already spread across 57 packages by a similar route.

The same lesson arrives from a third direction, through connections rather than code. Over nine days in August 2025 an intrusion cluster used access tokens stolen from a sales chatbot integration to query and export customer records from more than 700 organisations. Such a token is standing permission granted to one application to read another on your behalf, and it survives password changes because it was never a password. Every integration authorised years ago and forgotten is a supplier holding a key to the building.

Note. Two open-source compromises in three months. The August worm spread itself through an install hook, and at least one of its packages arrived with a valid provenance signature.

Why Illinois is the multiplier

On breach notification alone, Illinois is unremarkable. The Personal Information Protection Act requires an organisation to tell affected residents without unreasonable delay, and to notify the Attorney General when a single breach requires notice to more than 500 Illinois residents. A failure is treated as an unlawful practice under the state's Consumer Fraud and Deceptive Business Practices Act, which carries civil penalties of up to $50,000 per violation. Demanding, but broadly of a piece with the rest of the country.

The Biometric Information Privacy Act changes the arithmetic. Illinois is the only state whose biometric statute carries a private right of action, which is why the overwhelming majority of biometric class actions in the United States are filed there. The contrast is instructive. Texas has a comparable statute enforced solely by its Attorney General, with penalties up to $25,000 per violation and no route for an individual to sue. Washington enforces its version through the state consumer-protection regime. In Illinois the people whose data leaked bring the case themselves, and they do not have to show they were harmed.

Two developments have moved the numbers, both in the defendant's favour without removing the exposure. In August 2024 the legislature amended the Act so that repeatedly collecting the same identifier from the same person by the same method counts as one violation rather than one per scan, which had been the mechanism producing arithmetically absurd damages. In April 2026 the Seventh Circuit held that this amendment applies retroactively to cases already pending. Liability is now capped at one recovery per person rather than one per fingerprint. Across a large workforce, one recovery per person still reaches multi-million-dollar territory.

Note. Illinois is the only state whose biometric statute lets individuals sue directly. All three are final settlements. The smallest is what the first case to reach a jury eventually cost, after its $228 million award was set aside and damages were ordered to be retried.

Three regulators, one incident

The regulatory layer runs in parallel rather than in sequence, and its mechanics matter more than its headline numbers. Federal health-privacy penalties are tiered by culpability, but each affected record can be counted as a separate violation, and a single event exposing failures in risk analysis, notification timing and access control opens three penalty tracks at once, each with its own annual cap.

State attorneys general add a front that federal caps do not touch, and for listed companies the securities regulator adds a third. A material cybersecurity incident must be disclosed within four business days of the materiality determination, and the clock runs from that determination rather than from discovery. Judging materiality before the facts have settled is itself a risk, and it is a legal call rather than a technical one.

Federal health-privacy civil penalties, assessed on or after 28 January 2026

Tier (culpability)	Per-violation range	Annual cap applied
Tier 1: no knowledge	about $145 to $73,011	$36,505.50
Tier 2: reasonable cause	about $1,461 to $73,011	$146,053
Tier 3: wilful neglect, corrected	about $14,602 to $73,011	$365,052
Tier 4: wilful neglect, not corrected	up to $2,190,294	$2,190,294

Note. Each affected record can count as a separate violation, and a single incident can open three penalty tracks at once, each with its own annual cap.

The private bill is the larger one

Private litigation now moves faster than regulators, and it has been growing: the ten largest United States data-breach settlements totalled $515.75 million in 2023 and $593.2 million in 2024. The structure matters more than the total. Most settlements pay a flat sum of roughly $50 to $250 with no proof of loss required, alongside a documented-loss tier reaching $5,000 to $25,000. The flat tier is what makes the arithmetic dangerous, because it multiplies across the whole notified population rather than the few who can evidence harm.

Then there is the layer most boards assume is the backstop. About 40 per cent of cyber claims were denied or disputed in 2024, and three exclusions bite hardest here. Losses from an employee deceived into authorising access, which is the route these campaigns take, are frequently capped far below the policy limit. Claims are denied where the controls attested at underwriting cannot be evidenced afterwards. And many policies exclude regulatory fines outright, a substantial gap for a business exposed to both federal health-privacy penalties and a state biometric statute. The paper limit and the recoverable amount are different numbers, and the gap is widest for precisely the vendor-origin incidents this piece is about.

US healthcare and vendor data-breach settlements, 2025 to 2026

Matter	Settlement	What it followed	Status
Regional health network	$65m	2023 ransomware; clinical photographs published	Final approval, November 2024
Dialysis provider	$15m	April 2025 ransomware; about 2.7 million people	Preliminary approval only
University health system	$3.5m	August 2025 breach at a cancer centre	Preliminary; final hearing pending
Medical software vendor	$3m	July 2025 cyberattack	Preliminary; final hearing pending
IT service-management vendor	$1.8m	2024 vendor breach affecting a health system's patients	Preliminary; final hearing pending

Note. None of these is a fine. They are private settlements, and only the first has received final approval.

Why recovery takes weeks, not days

There is one respect in which this sector differs from every other target. A regulated manufacturer cannot simply restore from backup and restart. Every process must be revalidated and every system change documented before production can lawfully resume. The constraint is a quality obligation, not a technical one, which means the recovery clock is not set by the security team.

It lands on an industry already taking the heaviest fire. Manufacturing is now the most-attacked of the sixteen critical-infrastructure sectors, with each manufacturer facing roughly 1,585 attempted attacks a week and volumes up around 30 per cent year on year. Federal regulators have noted that commercially available manufacturing equipment often does not meet national or international cybersecurity standards by default, so the operational-technology layer is a standing weakness rather than a recent one. A recovery plan built to an ordinary disaster-recovery timeline is wrong before it is ever tested.

The signals arrive early, and they are cheap to watch

The encouraging finding is that most of the year's incidents were detectable at the identity and vendor layer days before data left the building. The strong signals cluster early and cost little to monitor. The financial, legal and reputational ones arrive late and merely confirm damage already done.

Inside the estate the tells are specific: a connected application nobody remembers authorising, single sign-on logins from unfamiliar geographies, repeated multi-factor prompts, and bulk exports against the customer database or the analytics warehouse outside business hours. In the build pipeline it is packages running install-time scripts that reach out to the network. Outside it, a supplier that discloses an incident, lets an attestation lapse, or cannot say quickly whether it uses the platforms currently being targeted. The behavioural signal is the one most often discarded: initial access is human, so a rise in help-desk impersonation calls is threat intelligence, particularly where staff report calls referencing real internal names or projects.

Knowing when to stop handling it internally is the other half. Any one of five triggers justifies paid help: suspected exfiltration rather than mere access, a third-party or cloud platform in scope, a live public-disclosure obligation, more than 500 Illinois residents potentially affected, or the arrival of an extortion demand. Two or more, and delay is the higher-risk course. The first call is an incident-response and forensics provider, ideally under a retainer signed in advance; the second is privacy counsel, because retaining counsel early lets the forensic work proceed under legal privilege and puts the materiality and notification judgements with a lawyer rather than an engineer.

Which specialist, for which trigger

Trigger	Right expert	What they do that in-house cannot
Single sign-on or OAuth-token compromise	Cloud and SaaS forensics specialist	Scope lateral movement across connected apps and tenants that internal logs miss
Malicious or signed package in the build pipeline	Software supply-chain specialist	Detect subverted provenance, since a compromised package can ship correctly signed
Extortion or ransom demand	Ransom negotiation and sanctions screening	Manage negotiation, sanctions exposure and evidence preservation
Large volume of records to review	eDiscovery and data-mining provider	Identify affected individuals from the exfiltrated data, rather than notifying on attacker claims
Listed-company disclosure	Securities counsel alongside privacy counsel	Judge materiality and timing for the four-day disclosure clock

Note. Engaging all of these pre-emptively is waste. Engaging the wrong one, mid-incident, is worse.

What it comes down to

Exposure for an Illinois pharmaceuticals or life-sciences organisation currently sits at the top of the scale, and is rising rather than levelling off. That is not the judgement of any single vulnerability but of a convergence: an active worm in the open-source supply chain, a social-engineering campaign working steadily through the sector, and a state carrying the most punitive privacy-litigation regime in the country.

Return to the asymmetry, because every part of the picture is a version of it. The failures were a supplier's help desk, a vendor's token store, a package maintainer's account, a billing company two steps removed. The consequences were the data owner's: the notification duty, the Attorney General threshold, the Consumer Fraud Act exposure, the biometric claim, the disclosure clock, the revalidation weeks. Nobody has yet built a mechanism that makes liability travel back up the chain to where the mistake happened, and until somebody does, the only sensible posture is to govern suppliers, identity and the build pipeline as hard as the perimeter that is no longer where the trouble starts.

Which leaves a question worth putting to any board in the sector. The controls defeated this year were not exotic or neglected. They were multi-factor authentication, vendor attestations from well-resourced platforms, and signed software components: the three things most organisations would cite if asked to prove they take this seriously. If those are the answer, the answer is already out of date.

Figures drawn from TheRiskAgent's risk briefing on software supply-chain and third-party cyber risk for pharmaceuticals and life sciences in Illinois (September 2026), which sources each one to a named publisher. Produced with AI research tools and reviewed before release; reference material, not advice.