Organized gangs are stealing prescription medicine in increasingly audacious heists. That’s a problem for Big Pharma and for patients, who can unknowingly buy stolen — and sometimes dangerous — medications.
FORTUNE — A few years ago a security expert visited Eli Lilly’s vast warehouse in Enfield, Conn., one of the pharmaceutical giant’s three U.S. distribution sites, where hundreds of millions of dollars’ worth of prescription drugs are stored. The expert was surprised to see the facility lacked a perimeter fence. There wasn’t even a $10-an-hour guard stationed outside. But Lilly officials assured the consultant there was nothing to be concerned about. Recalls the expert: “They were very proud to show me. ‘We have four-foot-thick walls.'”
He then looked up at the ceiling. “I was like, ‘What’s up there?'” he says. “There” turned out to be a standard tar roof with no extra reinforcement or fortification. Sometime later, Lilly’s security team suggested changes to protect the Enfield warehouse, including installing a fence. But those proposals went unheeded, according to two security experts in a position to know. Bob Reilley, Lilly’s chief security officer, says the company had a response in the works. But to listen to him today, it didn’t seem that urgent. “That warehouse had been there about 20 years in a nice industrial area,” Reilley says, “and was part of the community as well.”
Sure enough, Lilly’s (LLY) Enfield warehouse became the site of a headline-making heist — the largest pharmaceuticals theft in history. The burglars struck in the early-morning hours of Easter Sunday last year, as a heavy rain and windstorm knocked down trees and power lines, occupying local police.
Security was so lax that they pulled their tractor-trailer directly up to the loading dock and parked there for hours. Security cameras recorded the image of the truck, but no one was monitoring the cameras. The burglars drilled a hole in the tar roof and slid down ropes into the warehouse. Once inside, they disabled an alarm panel with a sledgehammer.
Another alarm went off at some point during the burglary, say those familiar with the break-in. Staff at ADT, which monitored the system, called the first name listed on Lilly’s contact sheet and left a message. By the time a Lilly employee responded, the burglars were gone, along with $75 million worth of cancer, psychiatric, and blood-thinning drugs.
Pharma: The most lucrative target
As Eli Lilly executives reeled, the media played it as a bolt-out-of-the-blue crime committed by high-tech pharma thieves. In fact, it wasn’t as unusual as it may have seemed. Only seven months before, a team of burglars — breaking through a warehouse roof in strikingly similar fashion — had made off with $6 million worth of prescription drugs from a GlaxoSmithKline (GSK) facility in Chesterfield, Va.
Indeed, theft of prescription drugs — once the realm of small-time criminals swiping a few bottles here and there — has graduated to the big time: Organized criminal gangs, many of them Cuban-American and operating out of South Florida, according to law enforcement, have dramatically increased both the size and the frequency of their heists.
Drugs account for about 15% of the estimated $8 billion to $12 billion in annual cargo theft, according to FreightWatch International, which advises Fortune 500 companies on supply-chain security. And the value of pilfered drugs has been steadily growing. Last year it rose 15%.
And pharmaceuticals top the list of the most lucrative targets. Of the 54 major pharma thefts that companies reported in 2010, the average value per incident was $3.7 million, according to FreightWatch. The next richest target: tobacco, at $1.4 million an incident.
Unlike cigarettes or cellphones, which thieves often peddle to the black market or abroad, drugs are typically sold back into the supply chain, says the FBI’s Tom Hauck, a special agent in an interstate theft task force out of the Newark division: “No one is selling Lipitor on the street.” Instead, as we’ll see, thieves sell the medicine to corrupt wholesalers and middlemen, and ultimately to pharmacies, where it is dispensed to unwitting consumers. Meanwhile the medicine can lose potency or turn toxic when not stored and shipped properly. Thieves, as you would imagine, ignore such safeguards, subjecting the meds to heat and other forces that can adulterate them.
Incidents in which patients are made sick because of stolen prescription medications bought from legitimate stores are almost never publicized. But Fortune has learned that in 2009, ineffective insulin hijacked from a truck months earlier was dispensed by pharmacies, including Kroger (KR). One patient in Ohio who took the insulin went into convulsions; another, in Texas, saw his blood sugar spike.
Kroger bought the stolen goods and resold them even after the drug’s manufacturer, Novo Nordisk, alerted the giant grocery and pharmacy chain about the theft. Kroger spokesman Brendon Cull declines to comment about the warning, but says,”We work with only safe and reputable organizations.” Kroger’s suppliers, he adds, must “follow all state and federal laws.”
In the past, critics have charged drug companies with being lax. Big Pharma has viewed security as “an area of cost savings,” says Patrick Sweeney II, founder of Odin Technologies, a company that specializes in protecting products through radio-frequency identification. “They don’t need it to sell, and they have insurance to protect against it.”
But now the industry is showing signs of getting serious. In February five drugmakers — Abbott Laboratories (ABT), Eli Lilly, GlaxoSmithKline, Johnson & Johnson (JNJ), and Novo Nordisk — announced the formation of the Coalition for Patient Safety and Medicine Integrity. They are seeking to amend the law governing cargo theft, which makes little distinction between stealing a load of cigarettes or chemotherapy drugs. The manufacturers want to change the criminal penalties to better reflect the risk to patient safety and give low-level participants more incentive to cooperate with investigators.
Just weeks after the group was formed, on March 8, six U.S. senators proposed a bill that would grant police new investigative powers, including wiretaps, and toughen penalties for drug theft, allowing the use of the Racketeer Influenced and Corrupt Organizations Act (RICO) to prosecute such cases. That would be a start. But for now, it seems, the thieves are still ahead of the law and the drugmakers.
Increasingly sophisticated adversaries
After the high-profile thefts of recent years, some pharma executives acknowledge, if only obliquely, that the industry has not made security a top priority in the past. Says Kevin Donovan, vice president of global security for Johnson & Johnson: “A lot of the assessments made by companies are risk-based analyses. They’re saying it’s not in a high-risk area.”
Lilly’s security chief defends his company. There was “not less security than there should have been” at Enfield, Reilley says, adding that the warehouse “did have a sophisticated security system that was compromised in the commission of that burglary.” Today Lilly’s warehouse has a fence and is bristling with other security enhancements that Reilley says he can’t discuss.
Would better security have changed the outcome? “Even with extraordinary measures in place, these things can happen,” says Mark Geraci, chief security officer for Purdue Pharma. He adds, “With all the security measures, banks still get robbed — and they get robbed a lot.”
Indeed, pharma faces sophisticated adversaries. The groups involved in bigtime theft are disciplined, prepare diligently, and clam up when caught. They are planners — with backgrounds in logistics, trucking, and construction — who patiently case warehouses, shadow truck stops, and detect security weaknesses.
In March 2009 burglars broke into a warehouse that stored Bayer products in Olive Branch, Miss. They severed alarm wires, sprayed the lenses of surveillance cameras black, and took the closed-circuit recording discs. They cut a hole in the exterior fence in case they needed an emergency exit. Then they helped themselves to $3 million worth of drugs.
At the GlaxoSmithKline warehouse in Chesterfield, burglars broke through the roof, climbed down a trapeze-style rigging, and hung from it as they disabled the primary and secondary alarm systems. The perpetrator, say two sources familiar with the investigation, exploited wiring shortcuts known to few within the company. Once inside, the burglars stayed for hours, loading two tractor-trailers with $6 million in drugs.
For all their precision, the thieves made two mistakes. Before they disabled the surveillance camera, it captured a grainy image of one of them. An informant identified the man as a 48-year-old Miami Cuban, a convicted burglar and electrician. The man was arrested but then released for lack of evidence. He has since been deported to Cuba, according to Immigration and Customs Enforcement records. The second mistake: One of the burglars left behind a coffee cup.
The FBI’s top pharma-theft cop
With his bald head, black sunglasses, and chiseled features, Tom Hauck looks like a G-man — the fearsome sort you’d see in an action movie. Despite his forbidding appearance, he is low-key, amiable, and modest to a fault. A 39-year-old former Marine and ex-manufacturing manager at Frito-Lay, Hauck has become one of the FBI’s top experts in pharma theft, learning to track the circuitous progress of pilfered drugs as they leave, and then return to, the supply chain.
Here’s how the system is supposed to work: Most medicines are sold by drugmakers to authorized distributors like AmerisourceBergen (ABC), one of the country’s largest, and then to pharmacies. A minority are sold through regional distributors that may specialize in certain types of drugs or supply particular treatment centers.
Then there’s a subset of the business, which Hauck discovered when he first began investigating the problem of drug theft a decade ago: a coterie of secondary wholesalers and repackagers that also resell drugs, typically far below wholesale prices. These middlemen, he says, often employ a flimsy cover story backed by forged documents. The drugs they buy and sell often have an illegitimate origin.
Hauck decided that if he wanted to find thieves, the FBI would need to become a middleman. “When you’re reacting [to the theft], you’re already behind the power curve,” says Hauck (who declines to discuss current investigations). “We wanted these guys coming to us, not us chasing them.” He set the FBI up as a wholesaler called Pills Plus Inc. His allies at pharma companies became silent partners, testing the drugs he was buying for authenticity. Hauck found stolen, unapproved, illegally imported, expired, and counterfeit drugs in the marketplace. The two-year investigation, which ended in 2004, was called “Operation Pill Collector.” It uncovered $100 million in illicit sales and resulted in 60 convictions.
It was a dramatic case. But, experts say, the problem has only gotten worse. It has left Hauck and his team trying to burrow inside the sleazy business to stop it from within.
From heist to pharmacists
So how do lifted drugs end up at your local pharmacy? Fortune has reconstructed one such episode through court records, adverse-event reports to the FDA, and extensive interviews. This one began on Feb. 5, 2009, when $10.9 million worth of Novo Nordisk pharmaceuticals were stolen from a tractor-trailer in Conover, N.C. The haul included almost 128,000 vials of Levemir, a long-acting insulin that requires constant refrigeration to preserve its potency.
Novo Nordisk immediately notified law enforcement and the FDA about the theft. Then, on Feb. 17, it FedExed a letter to all its authorized distributors and retail pharmacies, including Kroger, alerting them that three lots of Levemir had been taken, were unsafe, and should not be sold. It urged the companies to alert it should the drugs surface.
On Feb. 10, five days after the theft, at least 33,000 vials of the Levemir arrived at a licensed wholesaler called Ocean Pharmed in Irmo, S.C., according to an FDA investigator’s affidavit. One employee told investigators that he was summoned to the warehouse there after midnight to help unload 46 pallets of Levemir.
Ocean Pharmed quickly resold the drugs to another wholesaler, Altec Medical, in Easley, S.C., for about half the typical wholesale price. Such a huge discount usually means that the drugs come from an illegal source, the FDA affidavit states. Lawyers for Altec, which has since had its license suspended (state authorities will not say why), and Ocean Pharmed, whose license has expired and whose second-in-command pleaded guilty to unlicensed distribution of prescription drugs in another case, declined to comment.
Altec then sold at least 9,500 vials of the Levemir to HealthSource Distributors, a licensed wholesaler in Baltimore that had previously paid Johnson & Johnson $600,000 to settle a suit claiming it and other distributors traded in counterfeit J&J glucose test strips. HealthSource maintained it made reasonable efforts to verify the origins of the test strips. “A pawnshop does more due diligence,” counters attorney Geoffrey Potter, a partner at Patterson Belknap Webb & Tyler, which represented J&J in that case.
When HealthSource bought the Levemir, it came with a “pedigree” documenting its origin, as required by federal rules. But the pedigree was phony, according to the FDA affidavit. It falsely claimed the drugs were originally sold by Amerisource. Any experienced person, experts say, would know that a price far below wholesale is a red flag not to rely on the pedigree –the company would need to do some homework of its own. But Amerisource says nobody checked with it.
Kroger then bought the Levemir from HealthSource — despite the fact that Novo Nordisk had sent a warning. Almost immediately, people who purchased stolen Levemir from Kroger or other pharmacies had adverse reactions.
On May 13, 2009, at the M.D. Anderson Cancer Center in Houston, Dr. John Patlan saw a patient whose diabetes had been exacerbated by his cancer treatment. Patlan switched him to Levemir, which the patient purchased at an outside pharmacy. Levemir is supposed to lower blood sugar. But this patient’s levels spiked uncontrollably. “It was striking,” says Patlan. “It didn’t seem to make any sense at all.” Patlan contacted a hospital pharmacist, who reported the ineffective insulin to both the FDA and Novo Nordisk on June 4. (The patient recovered but later died from cancer-related causes.)
A week later Kroger notified Novo Nordisk that some of the stolen Levemir was on its shelves in Texas, Georgia, and Kentucky. The next day the drugmaker and the FDA put out nationwide alerts, warning patients that the hijacked insulin had resurfaced. Kroger removed the affected lots from its stores. Two months after that, more reports of adverse health effects linked to stolen Levemir rolled in, and the FDA sent out new alerts. To date, only 2% of the insulin has been recovered, says a Novo Nordisk spokesman.
To FDA officials, the Levemir case is highly significant. “That was the first incident in which we could directly link stolen products” to adverse events, says Dr. Ilisa Bernstein, deputy director of compliance in the FDA’s center for drug evaluation and research. Fortune has learned that federal prosecutors in Florida are conducting a criminal investigation into the drug’s theft and resale.
In March 2010, FDA investigators searched HealthSource’s offices in a different case, taking files on Levemir, Kroger, and Altec, according to an inventory of items seized. Benjamin Martin, a lawyer for HealthSource, says HealthSource “fulfills its obligation” to protect the integrity of the drugs it sells and complies with all laws. He also asserts, “There is nothing that gives me any reason to believe that there is any open investigation targeting my client HealthSource Distributors.”
In August the FDA found a second stolen drug on Kroger’s shelves. The drug, an antiseizure medication, was also purchased from HealthSource (before the Levemir episode, according to Kroger spokesman Cull). After the Levemir incident, Kroger stopped buying from HealthSource for “many months,” says Cull, until it was reassured that HealthSource had “the practices in place to make sure this didn’t happen again.” The buying relationship has since resumed.
A real solution
Despite the need to track drugs to prevent harm to patients, the best minds in pharma can’t seem to agree on how to make it happen. United Parcel Service (UPS) knows where every package is at every second. Electronics manufacturers put a unique serial number on every cellphone and TV. But such a system for authenticating drugs appears to be years away.
This leaves companies to track drugs by lot number, a blunt and inadequate tool since lots (a nonstandard measurement that can encompass many thousands of pills) are rarely stolen in their entirety. Unless a drugmaker recalls the entire lot, it has no way to distinguish with certainty the drugs that are stolen and dangerous from the pristine ones already sold.
The result: Companies resist lot-wide recalls when only a portion has been lifted. “If you lose one trailer load [to theft], now you lose four trailer loads under that lot number,” says Ed Petow, FreightWatch’s law enforcement liaison. Eli Lilly, after the $75 million theft, stopped distributing any remaining drugs that had the same lot number as those taken in the burglary. But it did not issue recalls. If the stolen medicine had started to enter the supply chain, says Lilly’s Reilley, “I think we would have gotten an indication.”
Perhaps. Most experts agree that the best way to keep stolen, diverted, or counterfeit drugs out of the supply chain is to require an electronic pedigree, or audit trail, for each medication as it moves through the system. That way drugs of dubious origin will draw immediate suspicion. With no federal standard, California passed a law in 2008 that would have required it by 2009. The industry backlash, claiming high costs and difficult logistics, was so great that full implementation was deferred until 2017.
At the same time, the FDA’s powers seem feeble. It can’t compel drug companies to issue recalls after thefts, or even to report or publicize thefts in the first place. Still, the Levemir theft and the Lilly heist seem to have galvanized the industry and the FDA. Since last year, the FDA has standardized its response to cargo theft and set up a web page to alert consumers to purloined drugs. At the FDA’s urging, companies are increasingly announcing thefts, hoping to brand the drugs as hot and make them harder to resell.
That’s what Lilly did after the Enfield burglary, and so far that seems to have worked. The stolen drugs have yet to reappear. Industry experts with knowledge of the case suspect that the burglars can’t, or won’t, try to sell them for fear of being caught, and that the medicine is likely holed up in a Miami warehouse. If the thieves do have interested buyers, they must vet them to see if they are actually corrupt or undercover law enforcement like the FBI’s Hauck fishing for product. Due diligence works both ways.
Meanwhile, as the investigation into the burglary at Lilly’s Enfield warehouse continues, the crime scene has yielded a clue: DNA found there matches that found on the coffee cup at the GSK warehouse, suggesting that at least one thief was involved in both burglaries. The genetic material points to a prolific convicted burglar — a fugitive Miami Cuban, according to sources familiar with the investigation.
But catching the man or his cohorts won’t be enough to solve the problem. As long as there are middlemen and pharmacies hungry for unlikely bargains, theft — and the chances of taking a dangerous drug — will only increase.
Also from Fortune:
