SPECIALSBeyond Cyberbiosecurity: Who controls biological data?
There are a number of instances where digital infrastructure of medical centers was targeted by hackers, one example being the disruption in operation of the All India Institute of Medical Sciences (AIIMS) digital platform following a ransomware attack in November 2022 in which systems that handle patient registration, appointment scheduling, diagnostic reports, billing and medical information became dysfunctional, thus causing the entire operations of the hospital to be conducted manually until restoration.
In recent cases that show the healthcare sector's vulnerability, a cyberattack reportedly caused server dysfunction at two hospitals in Delhi, Sant Parmanand Hospital and NKS Super Speciality Hospital, in June 2025. This shows the disruptive nature of cyberattacks to the healthcare sector in that not only are there disruptions in medical services and delayed access to the results of various tests, but also exposure of sensitive patient information.
Biological information is increasingly a valuable resource in healthcare, scientific research, and bioengineering applications. As biological sequences and other biological information flow from one laboratory to another, across national borders, and into cloud computing environments and computing infrastructures, we must answer an essential question: who controls this information, and under what conditions should it be shared?
At the IEEE Symposium on Security and Privacy in May 2026, the First International Workshop on Cyberbiosecurity was organised to cover security issues at the convergence of digital and biological infrastructures. On the other hand, discussions over the Pandemic Agreement of the World Health Organization (WHO) continue, including the issues of pathogen and sequence information sharing. This highlights a broader issue of securing biological information from unauthorised access and tampering without addressing the criticalities of ownership, sovereignty, accountability, and benefit-sharing. Cyberbiosecurity, therefore, needs to go beyond information security and address how biological information is governed and trusted.
Digital life of a biological sample and data sovereignty
The biological sample does not stay only in the laboratory where it is taken. It can produce genome data that can be digitised, transferred between organisations, processed with computing technologies, and stored in international databases. Even if such a sample stays in one lab, or one country, its information ends up in many places, creating an information supply chain of laboratories, sequencing centres, cloud service providers, software vendors, databases, and scientific organisations. Each has different technical capacities, legal responsibilities, and governance regimes. A vulnerability anywhere can compromise information outside the originating institution. In turn, cyberbiosecurity goes beyond protecting individual systems and considers the overall trustworthiness of the biological information system. It is not only necessary to secure a database or a lab’s network, but to ensure the information stays safe and trustworthy during inter-system transfer.
Transnational flow of biological information raises conflicting interests. On the one hand, states have a justified interest in securing sensitive health information and biological resources. On the other hand, individuals have interests in privacy, scientists require information for research, and public health crises demand rapid transnational cooperation.
This problem is reflected in current negotiations of the Pathogen Access and Benefit Sharing (PABS) system under the WHO Pandemic Agreement, which attempts to promote the rapid sharing of pathogens with pandemic potential and their sequence information, along with equitably accessed benefits (vaccines, diagnostics and therapeutics).
The exchange of information on pathogens can benefit public health, the scientific community, and the strategic interest of the country all at the same time. The lack of information exchange, similarly, can hinder scientific cooperation and impact epidemic containment efforts.
On the other hand, the exchange of such information without any proper governance might result in misusage, violation of privacy, questions about attribution, and unfair exchange of scientific benefits. Considering the importance of information flow in modern biotechnology, medtechnology and medical research, attempts have been made to consider the flow of information outside of pathogen access as well.
In September 2026 when WHO released its draft Code of Conduct for the WHO BioHub System. The draft covers all stages of handling biological materials and related information, from collection and transport to storage, use, further distribution, and documentation. This non-binding code aims to assist in responsible participation in the system. From a cyberbiosecurity perspective, the importance of biological materials and information needing collaborative governance is clear, since protecting a sample without information would be meaningless.
When biological data is manipulated
Cybersecurity issues often revolve around privacy -- keeping information from prying eyes. In biological terms, however, integrity becomes just as important. If we consider a genomic surveillance system where information hasn't been stolen but has been altered. Sequence information, laboratory results, or metadata may mislead scientists, produce inaccurate surveillance results, or even shape health policy based on faulty information.
As such, cyberbiosecurity cannot focus only on limiting access to biological information; it must also ensure the credibility of that information. Information provenance will play a key role in this effort. Systems must be able to trace the origin of information, the systems that processed it, whether it was altered, who accessed it, and how it was used later. This will create a digital trail of biological information.
Then comes the complication posed by artificial intelligence. Biological information can become input for computational modelling, experimentation, and the design of biological systems. Predictions produce experiments, experiments produce information, and that information feeds further computation.
The differentiation between information and action is therefore blurred. Any compromise to the database or computational output can affect decision-making in biological processes. The CyberBio26 workshop has identified several security challenges arising from this intersection, including DNA synthesis, lab automation, bioinformatics, and supply chain management.
Cybersecurity should cover data integrity, the security of software and models, and the reliability of biological processes that rely on the output of that data and software.
Bioeconomy of India and the Global South
This conversation is especially important for India since India has been incesting in its Bioeconomy. The India BioEconomy Report 2026, compiled by Biotechnology Industry Research Assistance Council (BIRAC), India's bioeconomy stood at US$ 195.3 billion in 2025, aiming at US$ 300 billion by 2030.
With expansion in biopharma, vaccines, genomics, industrial biotechnology, agriculture, and biotechnology services, reliance on secure and reliable digital connectivity will only increase. Laboratories, genome sequencing facilities, biotech companies, and production units will need secure platforms to exchange information.
India has an opportunity to incorporate cyberbiosecurity into biotechnology development from the outset. Priorities could include strengthening genomic data systems and laboratory information management systems, protecting automated laboratory equipment, developing cybersecurity standards for biotechnology supply chains, and establishing threat-intelligence exchange among government, academia, and industry.
Nonetheless, the security requirements must be backed by an investment in institutional capabilities. Major pharmaceutical corporations and well-endowed research centres can invest in sophisticated cybersecurity measures, whereas small laboratories and universities in less-resourced environments can hardly afford to.
Without technical support, workforce training, and sustainable funding, cyberbiosecurity could become a new barrier to international scientific collaboration. Such a situation would be especially harmful when further development of scientific capacity is needed to improve disease surveillance and respond to emerging threats.
International collaboration should thus support secure information exchange while preventing situations where access to required resources is limited to organisations that receive the most funding.
Cyberbiosecurity to Cyberbioresilience
Future cyberbiosecurity policy development cannot focus solely on preventing threats. No digital environment is perfectly safe, and any disruption to biological infrastructure could have effects that go beyond IT.
For example, a cyber incident in a laboratory information system could hinder diagnostics. Compromising the genomic surveillance system could disrupt the monitoring of outbreaks. Digital disruption of biomanufacturing processes could affect the manufacturing of health products.
Cyberbioresilience is a complementary policy objective, defined as the ability of biological research, biotechnology, and public health infrastructure to sustain core functions amid disruption, recover quickly, and confirm the authenticity of information before use. Thus, a cyberbioresilience policy would include tested backups and recovery plans, independent confirmation of critical data, contingency plans for lab functions, and coordinated incident responses by cybersecurity experts, laboratory staff, public health officials, and biosecurity personnel.
Resilience would not replace preventive security; it would acknowledge that successful protection also depends on the ability to identify failures, contain them, and recover without disrupting essential scientific or public health activities.
This kind of resilience will depend on cooperation across sectors, since cybersecurity, biotechnology, health data, biosafety, biosecurity, and artificial intelligence are often regulated in isolation, even though they are increasingly interconnected.
The United Nations General Assembly's high-level meeting on pandemic prevention, preparedness and response, which took place on 25 September 2026, reaffirmed the relevance of international collaboration and resilient health systems. Digital resilience must become an integral part of this preparation agenda.
Towards trusted biological infrastructure
The future of cyberbiosecurity will hinge on nations' and organisations' ability to build infrastructure that enables the exchange of biological information based on trust. Technical standards, strong authentication, audit trails, secure international platforms, governance responsibilities, and incident management procedures may help create such infrastructure.
Proportionality should be considered based on the nature of the information exchanged. Preparing for the next health threat will not just involve the speedy exchange of information. It will require assurance that the information exchanged can be trusted, be traced to its source, governance that can be held accountable, and the ability to keep critical operations functioning despite system failures.
For cyberbiosecurity to go beyond merely protecting biological information, it needs to serve as a foundation of trust for the entire biological information environment.
The author is Associate Fellow at Centre for Security, Strategy and Technology at Observer Research Foundation