GSK scientists accused of data theft in low-tech cybercrime case

Discussions about the threat of cybercrime typically invoke images of armies of hackers whose sole task is to steal data from corporations based across the globe. Yet, as GlaxoSmithKline ($GSK) is now finding out, when solid allegations of cyber-espionage surface a more mundane image of an insider armed with just an email account and a thumb drive emerges.

The U.S. Attorney's Office described such a scenario in a federal indictment filed this week. In the papers, a pair of former GSK researchers are accused of stealing trade secrets from the Big Pharma with a view to using the information as the basis for a business. The scheme is alleged to have run for more than three years, over which time Yu Xue is said to have emailed confidential files from her GSK address to a private account. Prosecutors claim Yu Xue then used her personal email account to share the files with her collaborators on the scheme.

In total, the indictment covers 16 emails, the first of which was sent back in July 2012. The following year, an unrelated researcher pleaded guilty to downloading oncology data from the Medical College of Wisconsin and scientists at Eli Lilly ($LLY) were indicted for allegedly pilfering trade secrets. The timeline presented in the Yu Xue case features the responses of the accused to these events, which include comments about being careful because GSK was stepping up its vigilance in the wake of the Lilly indictment. Prosecutors allege 11 of the emails were sent after the Lilly indictment went public.

GSK thinks the emails have had little effect on its business. "We do not believe the breach has had any material impact on the company's business or R&D activity," GSK said in a statement shared with Reuters. However, if the allegations prove to be true, the fact that researchers were able to syphon off trade secrets for more than three years, including those relating to programs developed by GSK's collaborator Five Prime Therapeutics ($FPRX), could be seen as harmful to the reputation of the Big Pharma and its ability to protect the data of the biotechs with which it works.

For now, nothing has been proven, something the attorney of Yu Xue was keen to emphasize. "Ms. Xue denies these allegations. She has pled not guilty and intends to contest these charges vigorously in court," the attorney said.

- read the indictment (PDF)
- here's Reuters' piece
- and FierceBiotech's take