This summer, a researcher sat down with an ordinary AI coding assistant and, in about forty-five minutes, produced a forensic DNA data file that blended two different people’s profiles into one. The file loaded cleanly into the same human-identification software that crime laboratories use every day, and it raised no alarm. The researcher, Nathan Adams of Forensic Bioinformatics, was not a criminal. His demonstration was part of a responsible security disclosure, and the flaw he exposed has since been patched. But the point it made lands hard: the thing we call “DNA evidence” in a courtroom is not a molecule. It is data. And data can be wrong, and in the right circumstances, changed.

For anyone whose case involves a DNA “match,” this is worth understanding, not as a reason for panic, but as a reason to ask better questions. Here is what actually happened, what did not, and why the real lesson is about the discovery rights that let a defense test the integrity of the data behind a result.

The DNA Molecule Cannot Be Hacked. The Data It Produces Can Be.

Start with the distinction the headlines tend to flatten. A bloodstain, a cheek swab, a hair root: these are physical matter. They can be contaminated, switched, or mishandled the old-fashioned way, but they cannot be edited over a network. What can live on a computer is everything the laboratory generates from that sample. From the moment a sample reaches an instrument, a DNA analysis becomes a chain of digital files: the raw electronic output of the machine, the software’s reading of that output into a profile, the statistics that turn a profile into a likelihood ratio, the laboratory’s case-management records, and finally the written report a jury sees. Almost nothing a juror is shown is the biology itself. It is the data about the biology.

That is not a reason to distrust DNA science which remains a powerful forensic tool.  It is a reason to recognize that the reliability of a DNA result now rests on two pillars, not one: the soundness of the biology, and the integrity of the digital pipeline that carries that biology’s findings from an instrument to a courtroom. The second pillar is the one almost no one talks about, and it is the one this year’s disclosure put a spotlight on.

What the 2026 Disclosure Showed and What It Did Not

On July 31, 2026, Thermo Fisher Scientific, whose Applied Biosystems instruments generate a large share of the world’s forensic DNA data, published a security bulletin disclosing a high-severity vulnerability designated CVE-2026-17583. In plain terms: in several of its widely used human-identification software products, the raw data files an instrument produces could, if a laboratory’s own security were bypassed, be altered after they were generated but before they were analyzed, and the software would not flag that anything had changed. The underlying weakness is believed to have been present in files from that instrument family for decades.

Two things about this matter as much as the flaw itself. First, what it was: a demonstrated, responsibly disclosed vulnerability with a working proof of concept, reported through the federal cybersecurity authorities and promptly patched. Thermo Fisher’s fix adds digital signatures, so laboratories can now verify whether a file has been altered after it was created. Second, what it was not: as of this writing, there is no confirmed real-world exploitation, no entry in the federal catalog of known-exploited vulnerabilities, and no public report that any actual criminal case was compromised. No one should conclude that a specific DNA result was tampered with. The honest takeaway is narrower and more durable: the integrity of forensic DNA data had a gap that could be exploited, which means integrity is something a court, and a defense, are entitled to see proven rather than assumed.

An important note: The new digital signatures protect files going forward. They do not, by themselves, tell anyone whether a file created years ago, in a case that is already closed, was ever altered, and the older, end-of-life instruments that received no patch rely instead on ordinary security controls. For post-conviction work in particular that gap is the interesting part.

This Is the Same Lesson DNA Software Has Been Teaching for Years

The cybersecurity angle is new, but the underlying theme is not. Readers of this series will recognize it from our piece on the software that increasingly decides DNA cases. Long before anyone talked about altering a forensic file, the programs that interpret complex DNA mixtures, probabilistic genotyping tools such as STRmix and TrueAllele, had already shown that “DNA evidence” is only as good as the code and the data behind it. These programs have had documented coding errors that changed the statistics they reported in real cases, and defendants have had to fight, sometimes successfully, for the right to examine their source code. In State v. Pickett, a New Jersey appellate court ordered that a defendant be given access to the source code of the software used to generate the numbers against him. The message of that fight, and of this year’s vulnerability, is identical: a DNA result is a human-and-machine product, and you cannot test what you are not allowed to see.

What a Texas Defense Should Actually Do

The practical response to all of this is not alarm. It is discovery. If a DNA result is part of the State’s case, the defense should insist on far more than the tidy final report, because the report is the last and least revealing link in the chain. The material that matters is the material that shows how the result was made, and whether the data behind it is what the lab says it is.

  • Demand the raw data, not the report. The instrument’s original electronic files, the electropherograms, are the foundation of everything that follows. A defense expert cannot check the work without them.
  • Get the software versions and validation records. Which programs, which versions, and were they the patched versions? Whether a lab was running unpatched or end-of-life systems is a fair and specific question now, not a hypothetical one.
  • Demand the audit trails and access logs. The laboratory’s own records of who touched a file, when, and how are exactly what can show a digital chain of custody is intact, or that it is not. These logs are not bureaucratic clutter. They are often what lets a result survive scrutiny, or what defeats it.
  • Ask about file integrity. Were the files digitally signed or hash-verified? Can the lab actually demonstrate, rather than assert, that the data has not changed since it was created?
  • Have a qualified expert re-analyze. Independent review of the raw data can catch ordinary error, subjective mistakes in interpretation, and, in principle, signs of alteration that a final report would never reveal.

In Texas, the tools to get there already exist. The Michael Morton Act (Article 39.14 of the Code of Criminal Procedure) gives the defense broad access to the State’s material, and “the State” includes the crime laboratory. The reliability of scientific evidence is tested under the Kelly standard, and forensic analysis is tied to laboratory accreditation under Article 38.35, with the Texas Forensic Science Commission as an oversight backstop. And where a conviction turns out to have rested on forensic evidence that has since been undermined, Article 11.073, the state’s junk-science writ, exists precisely to reopen it. None of these tools help a defendant who never asks for the data in the first place.

The Bottom Line

“DNA evidence” sounds like a fact of nature. In a modern courtroom it is really a stack of digital files, produced by instruments and software, handled by people, and carried across ordinary computer systems. That does not make it unreliable, and this year’s vulnerability did not tamper with anyone’s case. What it did was make undeniable something defense lawyers have understood for a while: the credibility of a DNA result depends on the integrity of the data pipeline as much as on the biology, and integrity is provable only when the defense can see the raw files, the software, and the audit trail behind the number. The lesson of this series holds here as everywhere. The label on the evidence is only as good as the method, the data, and the honesty behind it, and you are entitled to see all three.

Deandra Grant is a forensic lawyer-scientist and the first attorney in Texas to earn the ACS-CHAL Forensic Lawyer-Scientist designation. She holds an M.S. in Pharmaceutical Science and a Graduate Certificate in Forensic Toxicology, and she completed DNA for Lawyers, a week-long hands-on workshop taught by Dr. Greg Hampikian at Boise State University. She has spent three decades challenging the science behind the State’s evidence. This post is part of the Deandra Grant Law forensic science series.

Further Reading

  • Thermo Fisher Scientific, “Security Bulletin: CVE-2026-17583” (July 31, 2026), the manufacturer’s disclosure and patch guidance. documents.thermofisher.com
  • The Hacker News, “Thermo Fisher Patches Flaw That Could Allow DNA Data Tampering” (August 3, 2026). thehackernews.com
  • Budding Forensic Expert, “Can Forensic DNA Evidence Be Hacked? The New Cybersecurity Threat to Crime Laboratory Data” (August 2026), a careful overview of the disclosure and the digital chain of custody. buddingforensicexpert.in
  • State v. Pickett (N.J. Super. Ct. App. Div. 2021), granting a defendant access to the source code of probabilistic genotyping software; and, from this series, our companion post on the software behind DNA cases
  • Code Crim. Proc. Art. 39.14 (Michael Morton Act), Art. 38.35 (accreditation), and Art. 11.073 (junk-science writ); Kelly v. State, 824 S.W.2d 568 (Tex. Crim. App. 1992).

This post is an informational synthesis for educational purposes and is not legal advice. It describes a publicly disclosed and patched software vulnerability; as of publication, no real-world exploitation in an actual criminal case has been reported. Case citations should be independently verified against the official record before use in any filing.