The Fake Cancer Drug Came in a Real Vial
India will require QR codes on every cancer drug by July 2027. The Keytruda ring it responds to used genuine vials, stolen after they were emptied.
TL;DR
- Delhi police seized 519 empty Keytruda vials and over $120,000 from a hospital oncology manager's apartment; the ring refilled used vials with antifungal medicine and sold them at half price.
- Eight of nine tested samples contained no pembrolizumab. Patients in Nepal and Mexico died, and Peru and the Philippines issued alerts over falsified product.
- India now requires QR codes carrying nine data elements on every cancer drug unit sold in the country by July 2027, imported medicines included.
- The vials in this case were genuine, so a factory-issued code would have scanned clean. The fraud happened after dispensing, where forward-only tracking systems stop looking.
Delhi police searching an apartment in 2024 came away with 519 empty Keytruda vials and more than $120,000 in assorted currencies. The apartment belonged to a hospital oncology manager. The empties were the inventory.
Keytruda is the world's bestselling cancer drug. A 100-mg vial sells for around 150,000 rupees in India, over $1,500, which puts it beyond most families. According to the Cancer Calculus investigation by the International Consortium of Investigative Journalists and The Indian Express, a ring led by Viphil Jain collected used vials from hospitals and pharmacies, refilled them with antifungal medicine, and sold them at half the market price. Twelve people were arrested. Of nine samples tested from the New Delhi operation, eight contained no pembrolizumab, the drug's active ingredient.
The people who received those infusions had no way to know. Sita Gurung, in Nepal, was treated for two months while her cancer advanced, until she could no longer eat or talk. She died. In Mexico, Merck confirmed at least one death across four identified cases, and Francisco Chavez reported tremors, paralysis and a spike in blood sugar after his fourth dose; he still has chronic back pain and sudden episodes of paralysis. Peru and the Philippines issued alerts over falsified product.
India's health ministry has now responded. Cancer drug manufacturers have until July 2027 to put QR codes or barcodes on every unit sold in the country, imported medicines like Keytruda included. Vaccines, antimicrobials and narcotics fall under the same mandate. Each code has to carry nine data elements: a unique identification number for that unit, the manufacturing date, the expiration date, and the manufacturer's name and address among them.
It is a serious piece of regulation, and it addresses a real gap. It also runs into something specific about this case.
The vials were genuine. Every one of them came off a real production line, passed real quality control, and was dispensed to a real patient before it was stolen. Had India's mandate been in force in 2024, those vials would have carried factory-issued codes, and every one of those codes would have scanned as authentic, because it was. The counterfeiter never had to defeat the identity of the container. He waited until the container had finished its legitimate life and picked it up on the other side.
Serialization answers one question well: did this unit originate with the manufacturer. This scheme never needed that answer to come back false.
The experts quoted in ICIJ's reporting flagged a related weakness. Packaging can be replicated, and a fraudulent unit logged into the system ahead of the legitimate stock would read as the original when the real one finally showed up. Both problems share a shape. The code proves something about an object at the moment it was created. The fraud happens later, somewhere the system has stopped watching.
Note where the access came from. Not a port, not a warehouse, not a border crossing. A man who managed oncology inside a hospital, standing at the exact point where a vial stops being a tracked asset and becomes medical waste. It is the same failure we saw in the Memphis warehouse case, where the theft worked because the people entrusted with custody also controlled the paperwork.
There is a second-order effect worth sitting with. Once an empty vial has resale value, hospital waste becomes a commodity with a price on it, and a market forms around a stream that no inventory system was ever designed to track. This is what Europol and the EU Intellectual Property Office were describing in their 2020 report on poly-criminality, which argued that treating intellectual property crime as victimless leads enforcement to underweight what it actually costs. Here the cost was a woman in Nepal receiving antifungal medicine for two months while her cancer grew.
So what would have caught it?
Not an inspection of the vial, which was authentic. Probably not a scan at the counter, which would have returned a valid code. The evidence that something was wrong existed, but it lived in the relationships between events rather than in any single one of them. A serial number administered to a patient in a Delhi hospital, appearing weeks later in a pharmacy in another state. A quantity of a specific therapy moving through a region that exceeds the number of patients plausibly receiving it. A supplier whose prices sit at half of everyone else's, which the buyers presumably noticed and read as luck. Purchases that never reconcile against a manufacturer's shipment record.
Each of those is a network-level observation. None of them can be made by looking at one object very carefully, however good the code on it is. Item-level identity has its place; you want it when a case reaches a courtroom, and you want it at the counter. But it was not the missing control here.
The tracking systems being built run in one direction, from factory to patient, and they treat dispensing as the end of the story. This ring started there and worked backwards. The question India's mandate does not answer, and as far as I can tell nobody has answered well, is what a used unit looks like to a system that only ever tracks forward, and who is supposed to notice when one comes back.
Image: hospital pharmacy picking robot, Universitätsklinik Münster. Photo by UKM Elisabeth Deiters-Keul, CC BY-SA 3.0, via Wikimedia Commons.