Forty Genomes and a Wednesday in October

double helix, single copy

24 Oct 2026

Disclaimers

Opinions expressed in this post (and in any of my posts) are solely, unless otherwise specified, those of the author, me. They do not reflect the views, policies, or positions of any organization, employer, or affiliated group.
I work as a software engineer at the Institut Pasteur de Dakar. I am writing this as an individual, not as a representative of the institute. Everything I say here about genomic data is said with respect and consideration for the people who produce it, guard it, and study it.
Pi & GLM-5.3 helped me gather and verify the sources; the judgment calls, and any errors, are mine.

Hook

I have spent the last 20 years of my life shouting to anyone who will listen that Africa must turn to free and open-source software; it is a matter of sovereignty, safety and security.

Today, I am back to shout to anyone who will listen that Africa must, without fail, protect its data, epidemiological, medical and genomic data, all its data, all. And from what I can see at the moment, we’re already off to a really bad start.... wtf!

On Wednesday, October 21, 2026, Quest Diagnostics noticed that attackers were inside one of its lab-testing systems. Two days later, it told the American markets: patient records had been accessed. How many? Nobody knows. The company's security notice (published, quietly, with a piece of code asking search engines not to index it) says it is still investigating which kinds of data were taken.

As you may already know (or not), I work as a software engineer at the Institut Pasteur de Dakar where I build a Syndromic Surveillance System. In June, IPD sequenced the first 40 complete human genomes ever produced in Senegal. Forty files. The first complete genetic portraits this country has generated of its own people.

I have not stopped thinking about the distance between those two paragraphs. This article is my attempt to measure it.

Here is what I'll try to cover:

The most expensive data to lose

Quest is not an exception. It is the rule.

It was Quest's 2nd known major breach in a decade, in 2019, 11.9 million patient records were lost through a hacked billing contractor.

In 2026, a mass-wiping attack at Stryker in March, Boston Scientific's network offline for weeks in August, patient-data breaches at CareCloud, Craneware, and McKesson. Health tech has definitely become a major target for financially motivated criminals. Steal the sensitive data, threaten to publish, collect the money.

IBM has now counted healthcare as the most expensive sector in which to lose data: an average of $6.64 million per breach in 2026, against a $4.99 million global average. This streak has lasted 13 consecutive years.

Here are other interesting facts, they matter for what comes later:

Change Healthcare, February 2024. Ransomware shut down the company that routes prescriptions and payments across the United States. Roughly 190 million people. More than half the country had their records compromised.

Anthem, February 2015. 78.8 million records taken via spear-phishing, in an intrusion the FBI later attributed to state-sponsored actors.

Africa is not a bystander in these statistics. Check Point Research, in 2022, called Africa the most cyber-attacked continent on Earth: an average of 1,848 attacks per organization per week, against 1,164 globally.

RFI reported a cyberattack on Senegal treasury, the 3rd on a public institution in less than 6 months, highlights the vulnerability of African institutions to cybercrime. They talk about vulnerability; I’d have called it negligence, incompetence, a complete lack of understanding of the situation, but never mind.

Forty genomes in Dakar

Now the other paragraph.

In June 2026, the Institut Pasteur de Dakar announced that it had sequenced the first forty human whole genomes in Senegal, a first for the country, built on two parallel platforms, Illumina NovaSeq and Oxford Nanopore.

The first clinical application is deliberately concrete: breast cancer screening, with cervical cancer screening campaigns already running in the districts since 2024. Dr Ibrahima Socé Fall, the institute's CEO, tied the milestone to health sovereignty and to the continental efforts led by Africa CDC. Senegal joins South Africa, which sequenced the first human genome on the continent, in 2013, alongside Nigeria, Egypt, and Tunisia.

Forty genomes. It is not about the count. It is about what African genomes contain.

Africa is the source of all modern humans, that sentence is the opening of the abstract of one of the largest genetics studies ever done on the continent: 121 African populations, 14 ancestral population clusters, most of the deep branches of the human family tree in one study.

A separate pan-African program, H3Africa, working across 50 ethnolinguistic groups, discovered more than three million genetic variants that simply did not exist in any public database. That is the point: our data is not a copy of someone else's data. It is information about human biology that exists here and nowhere else.

Which means the forty genomes are, simultaneously:

a clinical asset: the beginning of precision medicine for Senegalese patients;
a scientific asset: diversity the field desperately needs;
a strategic asset: and this is the sentence the whole article turns on: the kind of asset that other people, with more money and better tools, may want very much to have.

The Institute of Pathogen Genomics exists because nearly 140 disease outbreaks are detected on the continent every year, and the genomic evidence to fight them should be produced and held in Africa. H3Africa was built from the start around fairness, African leadership, and preferential African access to African samples and data.

The worst kind of data to leak

Genomic data breaks every intuition we learned from password breaches.

A password can be rotated. A genome cannot. You cannot notify your relatives that their sequences are compromised, because your sequence is partially theirs. And it never expires: today's harmless annotation ("variant of unknown significance") is tomorrow's actionable medical fact about you, reinterpreted by whoever holds the file.

If you want to know what leakage looks like at scale, 23andMe is the full tutorial:

October 2023. Credential stuffing. Roughly 6.9 million users have their names, addresses, and genetic ancestry information scraped through a feature called DNA Relatives, then offered for sale online. The attacker did not take everyone. He specifically targeted Ashkenazi Jewish and Chinese users. A genetic-data theft with an enthinicity filter/angle.... Interesting, isn't it ?
March 2025. The company files for Chapter 11. After a contested auction, the assets go to a new owner for $305 million. The UK privacy regulator fines the company for a "profoundly damaging" breach.
Havasupai, 1990–2010. Members of the Havasupai tribe gave blood for diabetes research. The samples were reused, without consent, for schizophrenia, inbreeding, and migration studies. The last one directly contradicting the tribe's own origin beliefs. The 2010 settlement included returning the blood.
Henrietta Lacks, 1951–now. Cells taken without consent, commercialized for seven decades. The family settled with Thermo Fisher in 2023, reached a second settlement with Novartis in February 2026, and still has suits running against other companies.

(Side note: I had an encounter with a Spectrophotometer made by Thermo Fisher at IPD, I'll write an article about this device)

Small machines, big files

There is still a belief that sequencing is still a cathedral: huge white towers, Billie Hensen dollar machines, phalanxes of technicians. That was true fifteen years ago. Not anymore.

The Oxford Nanopore MinION, commercially available since May 2015, is described, accurately, as a "harmonica-sized" sequencer that plugs into a USB port and streams results in real time as the DNA is read. When I look at those devices, not gonna lie, I am impressed !!!

Sequencing ran in West and Central African institutes years before this week's news cycle: the Institut Pasteur de Bangui deployed a MinION for its public-health missions back in 2019.

A whole human genome is not sequenced "in minutes". Library preparation can take minutes to hours; runs stream in real time; whole genomes come back in hours to days. The revolution is that the stopwatch now runs on a device that looks like an Arduino or a RaspberryPi, costs a vanishing fraction of what it used to, and works in Dakar and Bangui as well as in Boston.

Africa CDC's pathogen-genomics program is deliberately building a distributed capability: many institutes, many countries, sequencers close to the outbreaks.

While we agree that distribution is the right architecture for public health, we should also agree that, this means, many more places holding valuable files: more laptops, more servers, more backup drives in drawers. More (back)doors to guard.

The afterlife of one domain

While researching this article I went to cite a document: the Bangui institute's 2019 announcement of its new MinION sequencer. Here is what I found instead:

From roughly 2010 to September 2024, pasteur-bangui.org was the website of the Institut Pasteur de Bangui. The Wayback Machine holds its homepage, unmistakably a research institute.
The domain lapsed. In March 2025, according to the .org registry's own records, it was registered fresh, by a new party. Transferred again in May 2026. Last modified August 2026.
Today, the domain serves a website titled "Pasteur Bangui" whose menu reads: Sports Betting Strategy. Casino Games, Slots. Bonuses & Gambling Mechanics. The institute's 2019 announcement about sequencing technology for the Central African Republic survives only as an Internet Archive capture.

The institute's current canonical presence is a member page on the Pasteur Network site, which lists no external website at all.

Nobody hacked anything. Nobody ran an exploit. A renewal was missed. An invoice was late, a registrant's attention slipped. And here we are, fourteen years of a research institute's public record became a casino's storefront.

I am not telling this to embarrass anyone, please. I am telling it because it's precisely the problem I'm trying to describe. We are not losing our scientific record to sophisticated adversaries. We are losing it to neglect. If that is the bar for our HTML, the bar our genomic archives have to clear is embarrassingly low.

The compact Ghana refused to sign

In April 2026, Ghana's cabinet rejected a proposed health compact with the United States, about $109 million over five years, meant, among other things, to replace USAID funding. In September, at the Council on Foreign Relations in New York, President Mahama explained why in terms so specific that I'm just better share the full quote with you:

"It states that we shall give the United States our pathogen profile. It also says we should give our medical records. I mean, who takes another country's medical records?"

The provisions he cited: hand over the national pathogen profile; hand over medical records; commit counterpart funding; and accept that medicines supplied under the program would not be subject to inspection by Ghana's own Food and Drugs Authority. His word for the terms: "humiliating." His description of the cabinet's response: "I've never seen anything thrown out as fast as that."

I want to be careful here: this article does not claim that any government is plotting to steal genomic data, by cyber attack or otherwise. It does not need to. The demand has already been put in writing, as a condition of aid. And a state-sponsored intrusion has already taken 78.8 million health records..... "My people are destroyed from lack of knowledge", book of Hosea (Chapter 4, Verse 6).

Anything that could go wrong will go wrong

The part where I'm supposed to scare you

When I started writing this piece, in my mind was the nightmare scenario: some people, working really hard to obtain one engineered pathogen, aimed at one continent, aimed at one people. Now that I'm reading this carefully, let's be honest, this is bad biotechnology or bad Sci-Fi, lol. Maybe I should write a book or direct a movie.

A weapon keyed to "Africans" is keyed to most of the human family tree at once because Human Beings share roughly 99.9% of their genetic code. Race is a social construct, not a distinct biological boundary.

Still.... The documented harms actually are already in this article: a state asking for a nation's pathogen profile as a contract term; a state-sponsored theft of 78.8 million health records; a genetic database with an ethnicity filter sold to the highest bidder; blood taken for one study and used for another; cells commercialized for seventy years.

The boring apocalypses. No conspiracy, no Sci-Fi required.

What we actually do

As an engineer, I will end the way engineers should: with the checklist:

Treat genome files like keys, not like spreadsheets. Encryption at rest. MFA on every account, especially the service ones. Fine grained permissions. Access logs. Audit trails.
Backups that are tested, including the "we can delete it" scenario. Genomic archives need the same disaster drills as financial systems and a policy, written before the crisis, for what deletion and consent-withdrawal mean for derived data.
LLM hygiene for labs. Nothing genomic (sequences, metadata, cohort descriptions, etc...) goes into tools (llm or other) not governed by the institute's data policy.
Use the sovereignty machinery that already exists. The genomic sovereignty framework, H3Africa's governance model: African leadership, African data hosted under African rules with preferential African access.
Renew your domains. If we cannot keep custody of our domain names, the argument for keeping custody of our genomes is being made against us, in public. Pure Shame with capital S.

None of this stops a determined state actor. But the documented history of this entire subject is a history of ordinary failures: reused passwords, missed renewals, unread contracts, unasked consent....

Nothing is lost, nothing is created, everything is transformed. Lavoisier.