INDUSTRY FACT FILE · PHARMACEUTICALS & LIFE SCIENCES

Five New Case Studies in Pharma Security

Original 2026 case studies, each written as a blog post, showing how current threats play out in pharma and life sciences and how Codec Networks services break the attack chain.

In this document 1.  About these case studies 2.  Case Study 1: The Plant That Stopped for a Week 3.  Case Study 2: The Formulation That Left With a Scientist 4.  Case Study 3: The Trial Data on a CRO's Laptop 5.  Case Study 4: The Audit Trail Someone Switched Off 6.  Case Study 5: The Research Partner's Shared Drive

These five case studies were written for this document set and have not been published elsewhere. Each is a composite scenario combining attack techniques and control failures widely observed in pharma and life sciences with the obligations that apply in India as of October 2026—in particular Revised Schedule M, the NDCT Rules, export-market data integrity rules, CERT-In's Directions and the DPDP framework.

Important disclosure The organisations described are fictional and the scenarios are illustrative. They are not accounts of real incidents, and they are not Codec Networks client engagements or claims of achieved outcomes. Their value lies in showing how connected weaknesses form an attack chain, which controls break it, and which services test those controls.

Case study	Organisation type	Core threat	Regulatory lens	Primary bundles
1. The Plant That Stopped for a Week	Formulation manufacturer	Ransomware crossing from IT into OT	Schedule M; CERT-In	B3, B7, B8
2. The Formulation That Left With a Scientist	Specialty pharma company	Insider IP exfiltration	Trade secrets; contracts; DPDP	B6, B7, B8
3. The Trial Data on a CRO's Laptop	Contract research organisation	Clinical data on an unencrypted endpoint	NDCT Rules; ICMR; DPDP	B9, B6, B8
4. The Audit Trail Someone Switched Off	QC laboratory at a manufacturer	Data integrity failure in lab systems	Schedule M; Part 11; Annex 11	B4, B2, B5
5. The Research Partner's Shared Drive	Biotech research collaboration	State-backed espionage via a partner	CERT-In; contracts	B9, B7, B10

The attack began in finance. It ended on the tablet line.

At a glance
Organisation	A formulation manufacturer (“Pharma A”) with export approvals
Threat	Ransomware spreading through a dual-homed engineering workstation into MES and SCADA
Why it is new	Weak IT/OT boundaries turn IT incidents into production stops
Codec Networks services	OT segmentation, SOC monitoring, incident response (Bundles B3, B7, B8)

The scenario

Attackers phished a finance user and moved through Pharma A's IT network.

An engineering workstation connected to both IT and OT networks gave them a path into MES and SCADA servers, which were encrypted.

Batch production and release stopped for a week. Pharma A missed supply commitments and had to assess GMP record integrity.

Figure 8: Illustrative attack path for Case Study 1 and the controls that break it.

What went wrong

• Dual-homed systems bridged IT and OT.
• No IT/OT DMZ.
• OT assets were not monitored.
• Batch records and OT configurations had no offline backups.

The impact

Pharma A lost production, faced customer penalties and had to show regulators and clients that records were intact.

The regulatory lens

• CERT-In Directions: incidents reported within six hours.
• Revised Schedule M: integrity and availability of GMP records and computerised systems.
• Export-market rules: data integrity expectations during inspections.

How Codec Networks would help

Need	Codec Networks response	Bundle
Separate IT and OT	OT segmentation and DMZ review	B3
Watch the plant	24x7 SOC with OT monitoring	B7
Recover	Ransomware response and OT recovery	B8

Key lessons Eliminate dual-homed systems. Build an IT/OT DMZ. Monitor OT assets. Back up batch records offline.

The files left weeks before the scientist did.

At a glance
Organisation	A specialty pharma company (“Pharma B”) developing complex generics
Threat	A departing scientist copying formulation and process files
Why it is new	Research IP is the company's most valuable asset
Codec Networks services	DLP and classification, UEBA, forensic investigation (Bundles B6, B7, B8)

The scenario

A senior scientist accepted an offer from a competitor and resigned with a notice period.

In the weeks before leaving, the scientist copied formulation development files and process data to personal cloud storage and USB drives.

Months later the competitor filed for a similar product. Pharma B commissioned a forensic investigation to support legal action.

Figure 9: Illustrative attack path for Case Study 2 and the controls that break it.

What went wrong

• Research data was not classified.
• No DLP on cloud uploads and USB.
• Unusual access volumes raised no alert.
• Leavers' activity was not reviewed.

The impact

Pharma B faced litigation costs, potential loss of market exclusivity and a review of IP controls.

The regulatory lens

• Trade-secret and contract law: confidentiality obligations of employees.
• Evidence requirements: forensically sound collection for legal action.
• DPDP Act and Rules: employee monitoring must respect personal data obligations once provisions commence.

How Codec Networks would help

Need	Codec Networks response	Bundle
Classify and protect	Research data classification and DLP	B6
Spot unusual access	UEBA monitoring	B7
Investigate	Forensic investigation and evidence handling	B8

Key lessons Classify research data. Control USB and cloud uploads. Monitor unusual access. Review leavers' activity.

The data should never have left the EDC system.

At a glance
Organisation	A CRO (“CRO C”) monitoring a multi-site trial for a sponsor
Threat	A stolen laptop holding trial data exports without disk encryption
Why it is new	Exports outside validated systems escape their controls
Codec Networks services	CRO assessment, privacy programme, incident response (Bundles B9, B6, B8)

The scenario

A CRO C monitor exported trial data from the EDC system to work offline during site visits.

The laptop was stolen from a vehicle, and disk encryption had not been enforced.

CRO C had to assess exposure of participants' health data and inform the sponsor and ethics committees.

Figure 10: Illustrative attack path for Case Study 3 and the controls that break it.

What went wrong

• Data was exported outside validated systems.
• Disk encryption was not enforced.
• The sponsor had not assessed CRO endpoint controls.
• No breach playbook for trial data.

The impact

CRO C faced sponsor penalties, ethics committee reviews and potential DPDP exposure once breach provisions commence.

The regulatory lens

• NDCT Rules 2019 and ICMR guidelines: protection of trial participants and confidentiality of records.
• DPDP Act and Rules: safeguards and breach intimation once provisions commence.
• CERT-In Directions: incidents reported within six hours.

How Codec Networks would help

Need	Codec Networks response	Bundle
Assess the CRO	CRO security assessment	B9
Protect participants	Clinical data privacy programme	B6
Respond	Incident response and notification support	B8

Key lessons Keep trial data in validated systems. Encrypt every endpoint. Assess CRO security. Plan for trial data breaches.

Nobody was hacked. The inspector still found a problem.

At a glance
Organisation	A manufacturer's QC lab (“Lab D”) using chromatography data systems
Threat	Shared logins and disabled audit trails allowing unrecorded reprocessing of results
Why it is new	Security weaknesses become data integrity findings
Codec Networks services	Data integrity assessment, application review, governance (Bundles B4, B2, B5)

The scenario

Lab D's analysts shared a few generic logins on chromatography systems for convenience.

Audit trails had been disabled on some systems to 'save space', and results were sometimes reprocessed without records.

During an inspection, the gaps were identified, raising questions about product release decisions.

Figure 11: Illustrative attack path for Case Study 4 and the controls that break it.

What went wrong

• Shared logins on lab systems.
• Audit trails disabled.
• No periodic review of audit trails or access.
• Configuration changes were uncontrolled.

The impact

Lab D faced inspection findings, retesting and remediation costs, and risk to export market access.

The regulatory lens

• Revised Schedule M: expectations for computerised systems and data integrity.
• US FDA 21 CFR Part 11: controls for electronic records and signatures.
• EU GMP Annex 11: computerised system requirements.

How Codec Networks would help

Need	Codec Networks response	Bundle
Assess integrity	Computerised system and data integrity assessment	B4
Fix the systems	Lab application access and configuration review	B2
Govern access	Access and audit trail review procedures	B5

Key lessons Give every user a unique account. Keep audit trails on. Review audit trails regularly. Control configuration changes.

The breach happened at the partner. The data was ours.

At a glance
Organisation	A biotech firm (“Biotech E”) co-developing a vaccine with a research institute
Threat	Spear-phishing of a partner researcher leading to theft from shared research drives
Why it is new	Research collaborations extend the attack surface
Codec Networks services	Partner assessment, threat hunting, phishing simulation (Bundles B9, B7, B10)

The scenario

A state-backed group targeted researchers involved in Biotech E's vaccine collaboration with tailored phishing emails.

A partner researcher's account was compromised, giving access to shared drives holding joint research data.

Data was exfiltrated over months before threat intelligence prompted a hunt that uncovered the intrusion.

Figure 12: Illustrative attack path for Case Study 5 and the controls that break it.

What went wrong

• MFA was not phishing-resistant for researchers.
• Shared drives had broad access.
• Partner security was never assessed.
• No threat hunting for espionage tradecraft.

The impact

Biotech E reviewed the partnership, reported the incident and rebuilt its collaboration model.

The regulatory lens

• CERT-In Directions: incidents reported within six hours.
• Collaboration agreements: security and confidentiality obligations of partners.
• National security: coordination with authorities where research is strategic.

How Codec Networks would help

Need	Codec Networks response	Bundle
Assess partners	Research partner security assessment	B9
Hunt	Espionage-focused threat hunting	B7
Prepare researchers	Targeted phishing simulations	B10

Key lessons Use phishing-resistant MFA for research. Restrict shared drive access. Assess partner security. Hunt for espionage tradecraft.

Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99   Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com   Web: www.codecnetworks.com