Originally published on Medium.
A Falsified Transplant Drug Reached India Twice. The First Had a Fake Serial Number, the Second a Real One.
In 2023 the counterfeit carried a serial number that did not belong to its batch. The one India’s regulator warned about last week carried a serial number that did, and the only thing that gave it away was the artwork.
On 21 September 2026, Gentium S.r.l. of Villa Guardia, Italy, received an authenticity inquiry from India about a carton of DEFITELIO. Gentium is the marketing authorisation holder for the product, which is manufactured by Patheon in Ferentino. The inquiry was unusual given DEFITELIO has no marketing authorisation in India at all. There is no lawful route for a carton of it to be sitting in an Indian supply chain.
The carton gave every sign of being genuine. The batch and the serial number both matched a real batch. What did not match was the printing. Compared against an authentic retention sample held by the company, the carton showed multiple differences in text layout, font, artwork and presentation. On 26 October 2026, India’s Central Drugs Standard Control Organisation issued a public alert over the suspected falsified product, signed by the Drugs Controller General, Dr Rajeev Singh Raghuvanshi. The Government of Upper Bavaria had already notified Germany’s federal medicines agency and recorded the falsification as verified.
A real number on a fake box. And three years earlier, the same drug, the same country, with the number wrong.
What the drug is
This matters before anything else, because it determines who is harmed.
DEFITELIO is defibrotide. It treats severe hepatic veno-occlusive disease, also called sinusoidal obstructive syndrome, in patients who have had a haematopoietic stem-cell transplant. It is approved for adults, adolescents, children and infants over one month of age. It is given as an intravenous infusion, ten sterile single-patient-use vials to a carton.
These are among the most compromised patients in any hospital. A transplant recipient with VOD is in a critical window, receiving a drug through a line, in a unit, from a hospital pharmacy. CDSCO’s warning was that a falsified version would be ineffective and could carry other serious risks that could be life-threatening, precisely because it is administered intravenously.
2023: the number was wrong
On 4 September 2023 the World Health Organization published Medical Product Alert N°7/2023, on falsified DEFITELIO detected in India in April 2023 and in Türkiye in July 2023, supplied outside regulated and authorised channels.
The manufacturer’s findings on that occasion read like a checklist of things a buyer could in principle have caught. The genuine lot, 20G20A, was packaged for the German and Austrian market, and the falsified product used UK and Ireland packaging. The expiry date was falsified and did not match the registered shelf life. DEFITELIO had no marketing authorisation in either India or Türkiye.
And this is the line that matters: the serial number was not associated with batch 20G20A.
In 2023, if you checked the number against the batch, the numbers disagreed with each other. The falsification was detectable from the identifiers printed on the box.
2026: the number was right
Three years later, same product, same destination, and that check no longer works.
The batch number and the serial number on the 2026 carton matched a genuine batch. Anyone verifying that the identifiers were internally consistent, or that the serial had been issued, would have found nothing wrong. The packaging was judged clearly fraudulent on artwork, not on data.
The number’s history is on record and it is worth following. The original fourteen-digit serial was decommissioned at Movianto in the Netherlands on 26 February 2025, and the pack was shipped to Gen Ilac in Turkey two days later, on 28 February 2025. The genuine batch was distributed to the United Arab Emirates, Cyprus, Spain, Finland, Israel, Portugal, Sweden, Slovenia, Turkey and Uruguay.
India is not on that list. The number was last seen, in the system that tracks it, leaving the European Union.
Here is our reading of that, offered as reasoning rather than as reporting, because no source states it. Under the European verification system, a pack being exported out of the EU is decommissioned at the point of export. That is correct behaviour and exactly what the rules intend. It is also the moment the serial number stops being something the European system watches. From that point the identifier exists on a carton in the world with no live record expecting it anywhere. If you wanted a serial number that would survive a consistency check and never trip an alert, a decommissioned export pack is the one to have.
Whether that is what happened here is not established. What is established is that the number was genuine, that it had been retired nineteen months earlier, and that the carton it was printed on turned up in a country where the product is not licensed.
The crude version is still the normal version
It would be wrong to suggest every falsification has reached this level, and 2026 provides two counterexamples involving the same kind of hospital-administered oncology medicine.
On 16 June 2026 WHO published Medical Product Alert N°2/2026 on falsified JAKAVI, ruxolitinib, detected in Iran, the Russian Federation and Türkiye and reported to WHO in May. Novartis confirmed that batches AVT50, FNR06 and SGL04 are not valid batch numbers, and analysed a sample of the 20 mg AVT50 product found in Türkiye, confirming the absence of ruxolitinib. It also reported that blister strips from falsified AVT50 and SGL04 cartons carry no batch number at all. The alert was sold to patients through online platforms and, in at least one instance, supplied from a pharmacy.
On 3 July 2026 WHO published Medical Product Alert N°3/2026 on falsified DARZALEX, daratumumab, reported by the national regulators of the Maldives and Mexico in May and June. Janssen confirmed that batch numbers MYS7381 and STV1K01 are not valid. The Maldives Food and Drug Authority reported visible particulate matter in vials of batch STV1K01. WHO states plainly that no laboratory testing has been conducted on these products. They were supplied or offered by non-authorised distributors, and in at least one case hospitals received them.
In both of those cases the batch number was invalid. Check the number, catch the fake. That is the failure mode the industry has built its tooling around, and it is still the common one.
Defitelio in 2026 is the other kind, and it is the kind the tooling does not catch.
What actually did the work
Strip the 2026 case to its mechanics and the detection chain was this. Someone in India thought a carton looked wrong and asked the marketing authorisation holder. The holder compared photographs of it against a physical retention sample it had kept. A German regional government verified the falsification and notified the national agency, which passed it toward the Italian authority. An Indian regulator then published an alert naming the batch.
Every step of that depended on a human being suspicious and a company holding an authentic sample to compare against. No scan produced it. No database query produced it. The serial number, the one piece of information the system is designed to check, would have reported the pack as fine.
And the limits of the case need stating. At the time of the notification this was a single reported incident. The holder had no physical sample to test, so nothing has been analysed in a laboratory. A search of the Jazz Global Safety Database found no other reports for the batch. No recall had been initiated and the investigation was ongoing.
What we are not saying
We are not saying serialisation failed or was a mistake. Serialisation caught the 2023 Defitelio falsification, it is what let Novartis and Janssen declare the JAKAVI and DARZALEX batch numbers invalid, and it is how the 2026 carton’s number could be traced to a Dutch warehouse and a Turkish consignee at all. A system that can tell you where a number was last seen is how this story is even legible.
We are not saying anyone in the lawful chain did anything wrong. Movianto decommissioning a pack for export is the system working as designed. Gentium kept a retention sample and answered an inquiry from a country it does not supply, which is why there is an alert at all.
We are not saying this is widespread. One carton, one inquiry, no sample, no recall, an open investigation.
And we are not saying our own field would have stopped it. A verification layer bound to the vial rather than printed on the carton changes what a hospital pharmacist can ask of a single unit. It does not stop a serial number being copied onto a box, and in a case where the only discrepancy was the font, the honest claim is narrow: it moves the check off the printed layer and onto the object, and that is all it does.
Who meets this problem
The hospital pharmacist in a transplant unit, holding ten vials for a patient who is already in trouble, whose available checks are the carton, the invoice and the supplier’s name.
The marketing authorisation holder that keeps retention samples precisely so that one day it can compare a photograph against them, and that is now the laboratory of last resort for its own product.
The regulator in a country where the drug is not licensed, who cannot work from a distribution record because there is no lawful distribution to record.
The wholesaler whose export decommissioning was correct, lawful, and the last time anybody saw that number.
And the patient, who is not told any of this and for whom the drug either works or does not.
If you are one of these people
If you buy or dispense hospital-only medicines. The thing that worked here was asking the marketing authorisation holder directly about a specific carton. That route exists, it is free, and it is faster than most people assume. A number that checks out is not an answer to the question of whether this box is that box.
If you hold a marketing authorisation. Your retention samples are now evidence in falsification investigations, and the comparison is done against photographs by someone under time pressure. It is worth knowing whether your own team could do that comparison today, for every presentation and every market’s artwork.
If you run a serialisation programme. The interesting number is not the one that fails a check. It is the one that passes. A decommissioned export serial is a valid, retired identifier with no live expectation attached to it anywhere, and it is worth asking what your system does if one reappears.
If you build verification, including us. Say which layer you are protecting. The 2026 Defitelio carton had correct data and wrong printing, which means the data layer was not where the fight was.
The difference between the two cartons
Three years apart, the same medicine for the same patients arrived in the same country by no lawful route. In 2023 the serial number did not belong to its batch. In 2026 it did.
Nothing else about the second carton was better. The printing was worse than the first one, which is how it was caught. But the one field that every verification system in pharmaceutical distribution is built to interrogate had been corrected, and the only reason anybody found out is that a company in Villa Guardia still had a real box in a cupboard to hold it up against.
Aeroz, Making Authenticity Checkable. Visit aeroz.io to learn more & get in contact with our team via [email protected].
© 2026 Aeroz. All rights reserved.