company allegedly hacked as reported by Settra with details: Exoimaging a company that sells diagnostic precision, reliability, and safety of medical equipment keeps an archive that tells a completely different storyabout a critical incident during cardiac arrest when the device froze and overheated, about the red of European certification for a year, about 226 units of measuring equipment with expired standardization up to 6.2 years, about a manufacturing fault surface for 5 years without resolution, and about 291,654 medical ultrasound images with patient personal data linked to employee names. This article is based on a portion of the company's documents to which we gained access. Patient names, internal identifiers of employees as research subjects, specific diagnoses, serial numbers of problematic devices, and banking details get been intentionally redactedthe troupe failed to protect them, so we are protecting them. Prologue. in medical device manufacturing, boundaries are always visible: standardization certificates, proof protocols, Device History Records. The files we obtained had none of this. 291,654 medical ultrasound images, 135 non-conformance reports, 63 customer complaints, equipoise sheets through April 2026, calibration data for 226 units of equipment, mark documents with surface lineament issues since 2021, employee resumes, BitLocker recovery keys, regulatory agreement about certification withdrawala portion of the company's archive stored without a single lock. What we found: Critical incident during cardiac hitch (April 4, 2025): Exo flag device froze when attempting to record video after payoff of spontaneous circulation, and 6 days later overheated and shut down after 15 minutes of use; Loss of European certificationformal withdrawal of eu MDR application in August 2025 and backdown of ISO 13485 certificates in october 2025, new notified body not identified, single year without ability to sell in the EU; 226 units of measuring equipment with expired calibration exceeding 2 years, including critical equipment for ultrasound measurements with overdue calibration up to 6.2 years; SCAR-2021-0001 open for 5 yearscritical manufacturing flaw (gold coat thickness 50% of required) at supplier Silicon Sensing Systems Japan, supplier did not respond, all corrective activity sections empty; 291,654+ medical ultrasound images4 patients with personal data (age, sex, diagnoses b-lines in lung, fatty liver), internal identifiers Cyrus, Johnny, Seshadri, Adriennenames of company employees as search subjects; 63 customer complaints over 6 months (December 2024 - June 2025), average 10.5 complaints per month: device overheating during use, loose connections, patient data loss in Exo Works software; BitLocker recovery keys for encrypted disks of 14 employeesin unprotected PDF files (Carol Bragg, Daniela, Gordon, Hani, Joe, Star, and others); Absence of signed lineament Agreements with three critical type 1 suppliers: Compal Electronics (Med gimmick OEM), SSI (supplier with open SCAR), ATLonly potation from september 2021; cicatrix 2024-09 with overdue corrective actions by 7.5 monthsabsorber delamination problem, Effectiveness chequer not performed; 67+ open NCRs (Non-Conformance Reports) as of 2026, including wafer yield issues (scrap), wrong sn during testing (traceability), reject tiles; Absence of cybersecurity testing: no penetration testing, vulnerability assessments, SBOM, CVE trackingviolation of FDA Cybersecurity Guidance 2023; utilize of out-of-calibration equipment under deviationsovens with 4.3-4.6 years overdue, leak tester (product seal test) with 3 extensions, impedance analyzer; Passwords in plaintext in Jupyter notebooks: Apr2020!, Exoimaging1!, redwood%6city, 314159; Absence of audits since 2021last FDA audit september 30, 2021, Internal audit october 6, 2021, no surveillance audits ISO 13485/MDSAP; 135+ Non-Conformance Reports, 61 closed, 7 cancelled, 67+ open; Recurring systemic defects: absorber delamination (NCR-0118, 0130, 0134), battery issues (NCR-0120, 0114, 0122), lens sealing problems (NCR-0124, 0127). a company that has existed long enough always has a ready resolve for one problem: corrective action, settlement, procedure updatequietly, without regulators, without press, without pattern. But the groups that now hold independent grounds for actionFDA and European regulators, hospitals and clients, employees, suppliers and partnersnumber four. one leak can be plugged with a corrective action. Not four systemic failures at once. Everything that follows is taken directly from the company's documents. Chapter 1. The companionship That Sells Precision ExoImaging Inc.American manufacturer of portable ultrasound diagnostic systems. Product: Exo iris 1.0 Portable Ultrasound Diagnostic SystemFDA 510(k) cleared (May 2021), class ii medical device for ultrasound imaging. headquarters was located in the silicon Valley area. The product is positioned as a portable ultrasound system for employ in exigency care, clinics, and outpatient practice. key promise: reliability, precision, mobility. support came through private equity fund ABRY Partners VII, which entered the capital in 2014. manufacturing of critical components was outsourced to external suppliers: Compal Electronics (Taiwan)OEM medical gimmick assembly, Silicon sensing Systems (Japan)MEMS components, ATL (Amperex technology Limited) (Hong Kong)lithium-ion batteries. Regulatory status according to archive documents: FDA 510(k): cleared May 2021 (Exo Iris 1.0) EU MDR: coating withdrawn august 21, 2025, ISO 13485 certificates withdrawn october 28, 2025, new notified body not identified ISO 13485: loss of certification October 2025 The archive shows a fellowship in financial decline. last FDA auditSeptember 30, 2021 (5 years ago). last Internal auditOctober 6, 2021. European certification lost a year ago. Production problems multiplying without closure. standardization of measuring equipment not updated for years. The companionship that sells diagnostic precision and medical equipment reliability has lost verify over four of its own pillars at once: patient safety, manufacturing quality, regulatory compliance, and personal data protection. Let's examine them in orderstarting with the most serious. Chapter 2. Cardiac Arrest: When Diagnostic gimmick Failed at Critical Moment The heaviest document in the archive is not about money. About a person at the minute between life and death. And about a device that failed at that moment. april 4, 2025. Santa Clara County Ambulance district (SCCAD) exigency medical service uses Exo Iris during two cardiac arrest cases. Incident 1 (April 4, 2025): After take of spontaneous circulation (ROSC)the instant when the nerve started thrashing againthe medic attempts to tape video of the ultrasound examination. The Exo Iris application freezes. Recording not saved. Visualization lost. From the investigation conducted by VP Quality and Regulatory Affairs personally with the user (document dated April 23, 2025): > chip indicated that the app crash did not contribute in any way to the shape of the patient. ROSC had already been achieved before he tried to usage Exo iris for this patient. ROSC was achieved before utilisation of Exo Iris. No damage to the patient from the failure. But think about the difference of single second. If ROSC had not been achievedif the physician had relied on continuous ultrasound visualization for decision-makingthe frozen application could hold cost a life. Incident 2 (April 10, 2025, same device): Exo Iris is used during a back cardiac arrest. After 15 minutes of operation, the device overheats and shuts down. complete loss of function. At a critical moment of exigency care. investigation (COM-0360) closed as Solved. But documents demo this is not an isolated overheating incident. Document: COM-0360 Investigation and MDR Justification Overheating is not an exception. It's a pattern: COM-0380: overheating COM-0403 (May 28, 2025): overheating and loose connection causing interruptions during examsoverheating + loose connection interrupting examinations i gimmick overheated during cardiac arrest. Others overheated during subprogram examinations. This is not coincidence. This is a design or manufacturing flaw that the fellowship did not fix. For FDA: COM-0360 describes failure of a class II medical device during apply in cardiac arrestcritical application where failure can cost lives. Verify whether a Medical Device report was filed. Overheating is a systemic problem per complaints. This is grounds for Field Safety notice or recall. For hospitals and clinics: if you utilise Exo iris in emergency care, knowdocumented cases of coating freezing and overheating with shutdown after 15 minutes exist. Santa Clara County Ambulance documented both incidents. These are not rumors. These are recorded events. Chapter 3. A twelvemonth Without Europe: How to lose certification and Disappear from market august 21, 2025 ExoImaging formally withdraws the EU MDR certification covering for product Exo Iris Ultrasound system (Basic UDI-DI: 00850018318006). Reference: MKA-2506-RQ12. reason stated in document: transfer to another notified bodytransfer to another certification body. EUDAMED (European database of medical devices) notified of withdrawal. october 28, 2025 certification body GMED officially withdraws ISO 13485:2016 certificates for ExoImaging: No. 39577 rev.0 and No. 39578 rev.1. Reason: ExoImaging chose carry-over to another certification body for ISO 13485 and MDSAP program. Consequences are immediate and irreversible: G-MED stain rights terminatedG-MED marking rights terminated. contract terminatedcontract with GMED terminated on certificate expiration date. The logic is simple: if a company changes notified body, the old body withdraws certification. The new body must lead a full scrutinise and issuing new certificates. Between withdrawal of old and receipt of new exists a gapperiod without certification. We searched the archive for documents about a new notified body. There are none. no get with new body. No certification timeline. No correspondence about choosing a new partner. Timeline: eu MDR application withdrawal: August 21, 2025 ISO 13485 credential withdrawal: october 28, 2025 Current date: October 6, 2026 certification gap: 1 year (from August-October 2025 to october 2026). Without ce marking based on EU MDR and ISO 13485, ExoImaging cannot legally sell Exo Iris in the European Union. 27 countries, 450 million potential patientsclosed. Technical documentation for the GMED application contains software classification memos, biological evaluation, sterilization methods, clinical evaluation guides. This is an archive of a dead application. Regulatory documentation for international markets (UK, Australia, Canada, Singapore, Japan, Taiwan, Brazil, Mexico, India, Saudi Arabia) shows a global expansion strategy. But without ISO 13485, even these markets become unreachablemany countries require ISO as a prerequisite for registration. For eu regulators: a medical gimmick that previously applied for eu MDR certification lost ISO 13485 a year ago and has not restored it. If ExoImaging attempts to sell in the EU without certificationthis is illegal placing on the market. For hospitals in the EU: verify CE marking status of any Exo Iris device. If manufacturing engagement is after October 2025it cannot hold valid ce certification. Chapter 4. Calibration: When precision Equipment Loses precision Medical gimmick manufacturing stands on measurements. coating thickness. Ultrasound frequency. Electrical resistance. Each parameter is controlled by equipment that must itself be calibrated with known accuracy and periodicity. When standardization is overdueprecision becomes assumption. 226 units of equipment with overdue calibration exceeding 2 years. 24 units with overdue calibration exceeding 4 years. Maximum overdue: 6.2 years. Equipment ID 0260 Keysight 364XA power Supply: last calibration: august 10, 2020 Current date: october 6, 2026 Overdue: 6 years 2 months Equipment ID 0337 Polytec PSV-F-500-HV Laser Vibrometer: last calibration: march 3, 2021 Overdue: 5 years 7 months Laser vibrometer is precision measurement equipment. It is used to characterize vibration parameters of MEMS componentsthe very ultrasound transducers at the heart of Exo Iris. If the vibrometer has not been calibrated for 5.5 yearsits readings have no proven accuracy. Any measurements made with it are technically invalid. Equipment ID 0254 Onda Hydrophone: last calibration: May 20, 2021 Overdue: 5 years 4 months The Onda hydrophone is the gold standard for measuring acoustic parameters of ultrasound systems. FDA requires validation of acoustic power and thermal effects for ultrasound diagnostic devices. The hydrophone is the instrument of this validation. If it has not been calibrated for 5+ yearsthe companionship cannot show that the acoustic power of Exo iris matches what was declared in the 510(k). Equipment ID 0512 ASG D4 Dispenser: last calibration: march 5, 2021 Overdue: 5 years 7 months The dispenser is production equipment for precise application of adhesive or sealant. If its accuracy has not been verified for 5+ yearsadhesive layer thickness may deviate from specification. This is a direct path to lens sealing problemsand NCR-0124 and NCR-0127 document exactly lens sealing issues. Equipment standardization records: apply of Out-of-Calibration Equipment Under Deviation The companionship knew about the overdue calibrations. And continued using the equipment. Formally. Under deviationdeviations approved by management. Equipment ID 0341 Forced aura Oven: Deviation D-0097 use of OOC Oven (OOC = Out of Calibration) Status: closed September 11, 2024 calibration overdue at time of use: 4.6 years Equipment id 0591 Forced air Oven: Deviation D-0102 expend of OOC Oven Status: closed september 11, 2024 Overdue: 4.3 years Equipment id 0688 Leak Tester: Deviation D-0115 expend of OOC Leak Tester Status: closed after 3 extensions leak tester is equipment for verifying product seal integrity. Exo Iris is a portable device used in hospitals and outpatient settings. It must live sealedprotection from liquids, sterility, safety. Leak test is a critical verification. And the company used the leak tester out of standardization for years under deviation. Equipment ID 0111 Keysight E4990A Impedance Analyzer: divergence D-0101 Calibration Due Date Extension Status: active extension Equipment ID 0131 Rohde & Schwarz SMA100A signal Generator: departure D-0118 Calibration Due Date lengthiness Status: active extension Overdue: 2.8 years Rohde & Schwarz signaling generator is a precision instrument for generating examine signals in electronics. If it has not been calibrated for nearly 3 yearsits output frequency, amplitude, stage noise are not guaranteed. Tests conducted with it are technically invalid. departure documents: D-0097, D-0102, D-0115, D-0101, D-0118 FDA 21 CFR 820.72 FDA requires (21 CFR 820.72): > Each manufacturer shall ensure that all inspection, measuring, and test equipment... is routinely calibrated, inspected, checked, and maintained. apply of out-of-calibration equipment without documented technical justification is a direct violation. difference is not technical justification. It is administrative permission to proceed use. It does not scratch the loss of accuracy. It only says: we know the equipment is out of calibration, and we consciously decided to employ it. For FDA: 226 units of equipment with overdue standardization exceeding 2 years, including critical measurement equipment for medical gimmick validation (hydrophone, vibrometer). This is systemic violation of 21 CFR 820.72. Any measurements made with this equipment after calibration expiration have no proven traceability to national standards. For hospitals: calibration of manufacturer's measurement equipment is not an internal companion matter. It is a ensure that the device you utilization for patient diagnosis meets stated specifications. If the manufacturer does not graduate its equipment for 5+ yearsit cannot show its product works as promised. Chapter 5. fin Years Without Answer: SCAR-2021-0001 and defect Nobody Fixed When a supplier delivers a critical factor with a defectthe manufacturer opens a cicatrix (Supplier corrective litigate Request)official requirement for the supplier to investigate, correct, and prevent recurrence. scar has structure: problem description ’ stem do analysis ’ corrective activity program ’ implementation ’ effectivity verification. Each step is documented. Each deadline is fixed. ExoImaging has a pock that passed through none of these steps. Opened sep 9, 2021. Status per document: WIP (Work In Progress). Supplier answer deadline expired october 9, 2021five years ago. SCAR-2021-0001 Supplier: Silicon sensing Systems japan Ltd. ECO #: 0008 Problem: Thickness difference in metal 3 (Pt for M3) gold (Au) depositiondeviation of gold finish thickness in metal 3 approximately 50% from place value. Specification: Ti/Au/Pt/Au/Ti: 100/300/250/100/20 nm and 100/400/150/100/20 nm Actual measurement: Ti/Au/Pt/Au/Ti: 100/150/250/50/20 nm and 100/200/150/50/20 nm Gold (Au) in two layers: instead of 300 nm150 nm (50%), instead of 100 nm50 nm (50%). divergence discovered September 2, 2021 through step height measurement data. Confirmed september 7, 2021 by SEM traverse segment photographs. Document: SCAR-2021-0001 (status WIP), FDA scrutinise materials 09.30.2021 Status of SCAR-2021-0001 Sections (per document): section 1 Problem Description: completed (defect description, discovery dates). section 2 supplier Investigation / root cause Analysis: EMPTY. no text. no 5-Why table. no fishbone diagram. No conclusion about cause. section 3 Exo acceptance of sue Plan: EMPTY. No corrective action project from supplier. no Exo approval date. section 4 Supplier Implementation of corrective Action: EMPTY. no evidence that supplier implemented anything. section 5 Exo effectiveness Verification contrive / corrective activity Effective: EMPTY. no effectualness verification plan. No conclusion whether problem was eliminated. litigate plan Expected Date: October 9, 2021 (5 years passed). Supplier did not respond. ExoImaging did not close SCAR. flaw not eliminated. What the Gold coat defect agency Gold in metal 3 is not decorative coating. It is portion of the electrical circuit of the MEMS devicethe microelectromechanical transducer that generates and receives ultrasound waves in Exo Iris. metal layer thickness determines its electrical resistance. If thickness is half the specificationresistance is twice as high (for thin films). This affects: Efficiency of converting electrical signal to ultrasound warmth generation Electrical characteristics (impedance) Durability (thin layers degrade faster) Exo Iris is a diagnostic medical device whose readings depend on ultrasound signal accuracy. If a critical component has 50% departure from specification, and this deviation is not investigated and not correctedit is impossible to guarantee the device works as designed. For FDA: SCAR-2021-0001 documents critical defect of element supplied by Japanese supplier for class ii medical device. Supplier did not answer for 5 years. All corrective sections empty. This is violation of 21 CFR 820.50 (Supplier Management) and 820.90 (Nonconforming Product). Verify whether ExoImaging continues using SSI Japan components in Exo flag production, and if yeson what basis are components with documented 50% difference considered acceptable. For hospitals: single of the critical components of your Exo iris may have gold coating thickness half the specification. supplier did not respond. Problem not eliminated. This is not theorythis is documented fact, open since 2021. Chapter 6. Medical Data and Personal Identifiers The largest find in the archive is not one document. It is 291,654 medical ultrasound images. Scans of heart, liver, kidneys, lungs, gallbladder, bladder, inferior vena cava. Organized into structured datasets for machine learning: train / validation / trial split. Each image is PNG or NPZ (compressed array). In file namestimestamps, gain parameters, compose numbers, examination types. Example: CARDIAC_CARDIAC_B_20231109164433_gain_m12_dr48_Frame_13.png LUNG_LUNG_B_20230613152947_gain_m10_63.npz 68,876 NPZ files. 182 directories with medical data. 25+ subjects for ML. Folders named: PATIENT_1, PATIENT_2, PATIENT_3, PATIENT_4, SUBJECT_1 ... SUBJECT_25+. medical data repository contains datasets for machine learning. PATIENT_1 File PatientNotes.txt: Patient: Late 20s, Male Pathology: Some b-lines in lung, fatty liver Comments: average Body, Difficult IVC Internal employment Only: Cyrus Images: 7,183 PNG Cyrus is not a medical code. It is a name. make of an ExoImaging employee who was a research subject. His medical dataage, sex, diagnoses b-lines in lung (pulmonary pathology), fatty liver (hepatic steatosis)are linked to his internal identifier. PATIENT_2 File PatientNotes.txt: Patient: Early 20s, Male Pathology: None Comments: Easy body Internal exercise Only: johnny Images: 6,219 PNG Johnny. Another employee. Another subject. Age, sex, absence of pathology, physical characteristicsEasy body (easy to visualize body). PATIENT_3 Patient: Late 40s, Male Pathology: None Comments: average body Internal employ Only: Seshadri Images: 5,566 PNG Seshadri. PATIENT_4 Patient: Mid 20s, Female Internal utilisation Only: Adrienne Images: 1,351 PNG Adrienne. Total: 20,319 medical images of 4 identified troupe employees. The problem use of employees as research subjects is legal practice. If there is informed consentwritten agreement signed by the subject, with explanation of purposes, risks, and confidentiality rights. But linking medical data with internal fellowship identifiers (employee names) and storing this data without encryption and access controlthis is violation of basic principles of personal medical data protection. HIPAA (Health indemnity Portability and Accountability Act) requires de-identification of personal medical data before employ in research. De-identification way removal of all identifiers that can tie-in data to a specific person: names, dates of birth, addresses, social security numbers. The name Cyrus in file PatientNotes.txt is a direct identifier. Together with age (Late 20s), sex (Male), and diagnoses (b-lines in lung, fatty liver)this is Protected health information (PHI). 7,183 ultrasound images of Cyrus, linked to his name and diagnoses, stored without protectionpotential HIPAA violation. For Office for Civil Rights (OCR) HHS: files take 291,654+ medical images with personal identifiers (names Cyrus, Johnny, Seshadri, Adrienne), diagnoses, and age. Data not de-identified. data not protected. control being of informed consent and HIPAA compliance for usage of employee medical data. For ExoImaging employees: if you were a subject of company ultrasound studiesverify whether you signed informed consent, and whether it explained that your medical data with names would be stored without encryption. Chapter 7. Complaints: ten Per Month, tetrad open customer complaints are the pulse of product quality. One complaint is coincidence. Ten per month is a pattern. 63 complaints over 6 months (December 2024 - June 2025). Numbers: COM-0350 through COM-0412. Average: 10.5 complaints per month. customer complaint documents: Recurring Defects Overheating: COM-0360 (April 4, 2025): overheating and shutdown after 15 minutes during cardiac stop COM-0380: overheating COM-0403 (May 28, 2025): overheating and loose connectedness causing interruptions during exams Connection Problems: COM-0412 (June 19, 2025): loose flag telegraph connection, device disconnects with slightest movementsNicklaus Children's Hospital COM-0403 (May 28, 2025): loose connection + overheating COM-0410 (June 17, 2025): probe not working after software updateNorthern Kentucky University Patient Data Loss (Exo workings go-ahead Software): COM-0409 (June 16, 2025): patient info disappearing from worklistGeisinger Health COM-0406 (June 5, 2025): ADT interface not workingGeisinger health COM-0404 (June 2, 2025): unable to attach MRN to patientOrlando Health, Inc. COM-0370: EMR/Epic integration problems power Problems: COM-0408 (June 11, 2025): probe won't turn on, no force COM-0390: charging problems COM-0412 (Nicklaus Children's Hospital) COM-0410 (Northern Kentucky University) COM-0406 (Geisinger Health) COM-0405 (Medispeak WePrep) repeat Customers Geisinger Healthmultiple complaints (COM-0409, COM-0406). This is not a random customer. This is a large medical system. If 1 customer files multiple complaintseither it has special usage conditions, or the problems are systemic. Medispeak WePrepalso multiple complaints (COM-0411, COM-0405). For FDA: 63 complaints over 6 months, average 10.5 per month. Recurring defects: overheating (minimum 3 cases, including critical during cardiac arrest), loose connection (minimum 3), patient data loss in software (minimum 4). control whether Medical Device Reports are filed for each complaint as required by 21 CFR 803. For hospitals: tick your own incidents with Exo Iris. If you observed overheating, disconnections, data lossyou are not alone. This is a documented pattern. Chapter 8. Production: 67 open Problems Non-Conformance describe (NCR) is a document recording departure from specification in production. Broken part. Incorrect assembly. Missed test. Each NCR must be investigated, dispositioned (Use as Is / Rework / Scrap), and closed. 135+ NCRs registered. 61 closed. 7 cancelled. 67+ open. Non-conformance documents: Critical open NCRs (2026) NCR-0135 Wafer relent egress quarrel Problem with wafer yield. Status: Scrapdisposal. Open. NCR-0133 wrong SN during testing wrong serial number during testing. This is a traceability problem. If serial numbers are mixed up during testingDevice History record becomes unreliable. in case of product recall, it is impossible to accurately identify problem devices. Open. NCR-0132 reject tiles investigation Investigation of rejected tiles (MEMS components). Open. NCR-0131 Tiles image issue image problems on tiles. Open. NCR-0128 reject tiles bit Rejection of tiles for disposal. Open. Recurring Problems Absorber Delaminationpersistent problem: NCR-0118: Absorber gap and delamination issueclosed NCR-0130: Absorber gap and Delaminationclosed NCR-0134: (context unclear from list, but mentioned) Related to pock 2024-09 (Appli-Tec)corrective actions overdue by 7.5 months, Effectiveness chip not performed. Battery Issues: NCR-0120: Probes with dead batteriesclosed NCR-0114: ATL battery issueclosed NCR-0122: FG Inventory-Depleted battery ATL (Amperex technology Limited) battery is a critical component of portable medical device. If batteries get depleted or rapidly degradedevice is unsuitable for field use. Lens Sealing: NCR-0124: lens sealing rework and investigationclosed NCR-0127: 10 probes lens sealing rework release (August 2026)closed lens seal integrity is critical for protecting optics and electronics inside probe from liquids. Hospitals use disinfection after each patient. If sealing is not reliableliquid can penetrate inside. For FDA: 67+ open NCRs, including traceability problems (NCR-0133), wafer yield (NCR-0135), recurring defects of lens sealing and absorber delamination. This is indicator of systemic problems in production quality control. Chapter 9. Suppliers Without Agreements medical device manufacturer is obligated to control its suppliers. 21 CFR 820.50 Purchasing Controls requires evaluation and approval of suppliers based on their ability to render products meeting requirements. caliber concord is the document that formalizes this: technical requirements, change procedures, complaint handling, audits. ExoImaging has three critical type 1 suppliers. None has signed quality Agreement. Approved supplier lean (September 30, 2021): 1. Compal Electronics, Inc. (Taiwan) Type: Med Device OEM (Original Equipment Manufacturer) Status: Conditionally Approved quality Agreement: no Compal is the primary manufacturer of Exo Iris. They gather the device. This is not a component supplierthis is a contract maker who performs critical assembly, testing, and packaging operations. The archive contains only supplier convert Notifications (SCN) from Compalchange notifications. no signed lineament Agreement. Multiple Deviations are associated with Compal: D-0074, D-0135, D-0022, D-0023, D-0027, D-0028, D-0033, D-0035, D-0036, D-0038. D-0135 Firmware Update at Compal (dated July 29, 2025, approved August 4-5, 2025): 35 problematic probes require firmware update due to disconnecting issuing during Pixel/Imaging/Device rase test. firmware is updated to version 5.4.2 directly at Compal factory after packaging. 35 devices were packaged with problematic firmware. This was discovered after packaging. This is indicator of insufficient lineament control at final production stages. Document: D-0135 firmware Update at Compal 2. silicon sensing Systems, Ltd. (Japan) Type: Sole source / Custom Component type i (Critical) Status: Conditionally Approved, Signoff PENDING quality Agreement: need quality Agreement (direct quote from supplier File) SSI is MEMS component supplier. Associated with SCAR-2021-0001 (gold coat defect). Supplier file directly states: need Quality Agreement. This is not fulfilled. Document: supplier File SSI (FDA audit 09.30.2021) 3. ATL (Amperex technology Limited) (Hong Kong) Type: Critical supplier Status: Conditionally Approved self Assessment: no (follow up required) ISO 13485 Certificate: No (only ISO 9001) quality Agreement: potation (dated september 29, 2021, unsigned) ATL supplies lithium-ion batteries for Exo Iris. Battery is a critical constituent of portable medical device. Supplier file ATL (September 29, 2021) shows: self Assessment: no (follow up required) lineament Agreement: No (follow up required) ISO 13485: no ISO 9001: Yes (expires september 15, 2024) certification contains Quality Agreement_ATL (dft)DRAFT, unsigned, dated September 29, 2021. Document: Quality arrangement ATL draft (FDA audit 09.30.2021) 5 years passed. draft did not become signed document. For FDA: class ii medical gimmick manufacturer works with three critical typecast 1 suppliers without signed character Agreements. This is violation of 21 CFR 820.50. Compalcontract gimmick manufacturerhas no QA. SSIsupplier with open scar for 5 yearshas no QA. ATLbattery supplierhas only 5-year-old draft. Chapter 10. BitLocker recovery Keys: When Encryption Becomes phantasy disc encryption protects data only as long as the recovery paint (BitLocker recovery Key) is not accessible to outsiders. Once the key falls into wrong handsencryption becomes formality. Anyone with the key can gain full access to the encrypted disk. Documents contain 14 PDF files with BitLocker recovery Keys: Carol_Bragg_edm-cbragg-bitlocker.pdf Daniela-T490.pdf Gordon bitlocker.pdf Hani.pdf Joe bitlocker.pdf LabMachine-T480s.pdf Star-NewComputer.pdf TRANSDUCER-T490 - Bitlocker recovery Key.pdf and others Each PDF contains a 48-digit numeric paint that allows unlocking the encrypted disc of the corresponding employee. These files were stored without protection, in the same archive folder containing patient medical data, financial reports, NCRs, SCARs, customer complaints. Carol Braggper circumstance of other files, possibly hr or administrative personnel. Gordonmentioned in testing files (Gordon laptop). Hanimentioned in production data (Hani\...). Joecommon name, context unclear. Starmentioned in other files (Star Massing, document control in 2021 audit). These are not abstract identifiers. These are real employees. Their encrypted disks contain work correspondence, cast documentation, possibly medical data, financial information. If an attacker gains access to the archivethey obtain BitLocker Recovery Keys. With these keys they can: steal physical disk (laptop, hard drive) of employee Unlock it using recovery key win full access to all data BitLocker encryption is useless if the recovery key is stored in plaintext. For employees: if your nominate is in the list aboveyour BitLocker recovery key was stored without protection. This means if someone gained access to the archive and steals your laptop or hard drivethey can unlock it. alter the key or rebuild encryption. For ExoImaging IT department: storing BitLocker recovery Keys in unprotected PDF files together with fellowship operational documents is violation of basic key management principles. Keys must be stored in Active Directory, cerulean AD, or specialized key management system with access control and audit. Chapter 11. finances and Absence of Audits last financial account in archive is dated April 2026. last FDA auditSeptember 30, 2021. last Internal auditOctober 6, 2021. 5 years without regulatory audits. no surveillance audits ISO 13485/MDSAP. no follow-up FDA inspections. Silence. fellowship lost ISO 13485 certification in October 2025. This event requires re-certification audit before restoration. Documents about such audit fare not exist. Sources: Internal documents of ExoImaging Inc., including non-conformance reports (NCR), customer complaints (COM), supplier corrective litigate requests (SCAR), equipment standardization records, regulatory correspondence, financial reports, and medical search data. Document period: 2012-2026, current as of october 2026.
