In the last piece I promised you a separate article on the cough syrup deaths. Here it is, and it is worse than I implied.
With Factor VIII you can at least construct a defence for the early years. The virus had no name until 1982. The assay came later. For a window of time, the hazard was genuinely invisible to the science of the day, and the crime was what the industry did after that window closed.
Diethylene glycol has no such alibi. It killed 105 people in the United States in 1937. It has had a pharmacopoeial limit for decades. The test that detects it is cheap, fast, and sitting in the monograph. Every single element of the safety system required to prevent the deaths in this article has existed, in writing, for the better part of a century.
So this is not a story about not knowing. It is a story about a barrel that remains perfectly legal right up until the moment somebody calls it a medicine, and about an industry that has arranged its paperwork so that this moment never quite arrives.
Three Names, One of Them Innocent
Three chemicals recur in what follows, and it matters enormously that you do not confuse them.
Diethylene glycol and ethylene glycol are the poisons. Alcohol dehydrogenase oxidises DEG to diglycolic acid, which destroys the proximal tubule; it takes EG to glycolate and oxalate, giving acidosis and calcium oxalate deposition. Neither has any legitimate place in a medicine at any dose. The pharmacopoeial figure of 0.10% is a contamination ceiling, not a permitted quantity.
Propylene glycol is something else entirely. It is an approved solvent in oral liquids and injectables, generally recognised as safe in food, and the same enzyme takes it to lactaldehyde and then to lactate and pyruvate — straight into ordinary intermediary metabolism. It is not the villain of this article. It is one of the sweet, viscous, unremarkable liquids that make a syrup a syrup, and that ubiquity is precisely why it is what the counterfeiters claim to be selling.
It is not perfectly innocent. Large cumulative intravenous exposure — lorazepam infusions, phenytoin, intravenous nitroglycerin — produces an osmolar gap, lactic acidosis and renal injury, and neonates clear it slowly because their alcohol dehydrogenase is immature, which is why European regulators set paediatric limits. But that is a dose and route problem in intensive care, several orders of magnitude away from what diethylene glycol does to a toddler at five millilitres.
Every incident in this article has the same grammar. A legitimate excipient named on the label; an industrial glycol in the drum.
Glycerin, substituted with diethylene glycol — Haiti 1996, Panama 2006, Coldrif 2025
Propylene glycol, substituted with ethylene glycol — Indonesia 2022, Uzbekistan 2023
Hold on to that. When we reach Indonesia, the entire point will be that the propylene glycol was never propylene glycol.
The Interval Is Shrinking
In July 2025 the WHO and the UN Office on Drugs and Crime published a joint report on excipient supply chain integrity. Its headline finding: at least 25 documented incidents of excipient contamination over the past 90 years, resulting in more than 1,300 deaths, many of them children.
It begins in 1937. A chemist at S.E. Massengill dissolved sulfanilamide in diethylene glycol because it tasted sweet and stayed in solution. One hundred and five people died. The Federal Food, Drug, and Cosmetic Act of 1938 followed directly — the founding document of modern drug regulation, and the original regulation written in blood.
It is tempting to read everything that follows as proof that those hundred and five people died for nothing. That is not what the record shows, and the truth is more uncomfortable than that.
The 1938 Act held. The United States has not had a mass poisoning from diethylene glycol in a domestically manufactured medicine since1. Ninety years, one control, no recurrence — about as clean a result as drug regulation ever produces.
Look instead at where the deaths went:
1985–86, Mumbai
1990, Nigeria
1990–92, Bangladesh
1992, Argentina
1995–96, Haiti
1998, Gurgaon
2006, Panama
2008–09, Nigeria
2019–20, Jammu
2022–23, seven countries
2025, Madhya Pradesh
For most of the twentieth century these incidents sat years apart. Since 2019 they have become close to continuous. Overlay the propylene glycol price spike of 2021 and the pattern stops being mysterious. When the legitimate excipient becomes expensive, the substitute becomes attractive.
This is not an institutional memory problem. It is a margin problem, and margins do not forget anything. They simply recalculate.
Panama 2006: Four Hops, One Certificate, Zero Tests
Here is the chain, in the order the barrels moved.
The manufacturer. Taixing Glycerine Factory, Jiangsu province, sold a product it called TD glycerin. TD stands for ti dai — substitute. Chinese quality officials later acknowledged the material was roughly 15% diethylene glycol mixed with other substances, and that the name was calculated to mislead. The accompanying certificate declared 99.5% pure glycerin.
The first broker. CNSC Fortune Way, a state-owned trading company in Beijing, brokered the sale in 2003. It had the certificate translated into English and issued it under its own name. Taixing’s identity did not survive this hop.
The second broker. Rasfer International, Barcelona. It copied the analysis it received, added its own logo, and shipped 46 barrels to Colón. It did not test the material; it later explained that as an importer it could not manipulate the product.
The importer. Medicom Business Group, Panama. By the time the paperwork arrived at its destination it described medical glycerin meeting US standards, and the shelf life of an already expired product had been extended from one year to four.
The manufacturer of record. The Caja de Seguro Social’s own government laboratory, which mixed the material into some 260,000 bottles of cold medicine, plus antihistamine tablets, calamine lotion and rash ointment.
Four companies. Three countries. One certificate, retyped three times. Zero identity tests.
The economics are not complicated. Diethylene glycol traded at roughly 6,000 to 7,000 yuan per ton at the time. Pharmaceutical-grade syrup ran to around 15,000. Half price, for a liquid that is odourless, sweet, and viscous in more or less the right way. That differential is the entire engine of this article.
And then there is the detail that should stay with you. The Panamanian syrup was sugar-free. Which is precisely why it was directed towards diabetic patients — and why so many of the dead were elderly people with hypertension and impaired renal function. The state health system had identified them as a population requiring particular care, and then delivered the poison to them on that basis.
The Classification Loophole
After the deaths, China’s Foreign Ministry issued a statement of position. Its drug regulator had concluded that the Taixing factory was not classified as a pharmaceutical production business, and that CNSC Fortune Way was not classified as a pharmaceutical sales business. Neither, therefore, came within the agency’s inspection scope. The material was categorised as an industrial chemical raw material rather than an ingredient of medicine.
Read that twice, because it is the most important sentence in this entire field.
It is not a denial. It is a jurisdictional statement, and as far as I can tell it is correct. Nobody had to break a pharmaceutical law, because nobody in the chain was subject to one. The regulatory perimeter was drawn around the word “pharmaceutical,” and the barrel simply never carried that word until it was already inside a patient.
The reflex is to file this as a Chinese peculiarity of 2006. It is not.
In Indonesia in 2022, the head of the drug agency testified that the solvents had entered the country through the trade ministry rather than through her agency’s import certification. The ethylene glycol came via a supplier of soap ingredients that repackaged industrial material under a chemical company’s logo taken from the internet, with certificates of analysis issued by an intermediary that had tested nothing.
In the Uzbekistan case, the propylene glycol reached Marion Biotech from a trader that held no licence to sell pharmaceutical-grade material and dealt in industrial grade only.
In Nigeria in 2008, the teething syrup manufacturer bought from an unregistered chemical dealer.
Four jurisdictions, four decades, the same hole in the same place. At that point it stops being coincidence and becomes architecture.
In the previous piece I described regulatory arbitrage across borders: a product too dangerous to sell here, sold there. This is arbitrage across definitions, and it is considerably more elegant, because you do not even have to move the goods.
The Denominator Problem
This next section is where my own profession should feel genuinely uncomfortable, because it is a data question and we are supposed to be good at those.
How many people did Panama kill in 2006?
51 — confirmed by Panamanian authorities in late 2006.
94 confirmed, with 293 further deaths under investigation — the prosecutor’s position in 2007.
Approximately 115 — the forensic institute’s figure. It examined 763 candidate cases and classified 174 as diethylene glycol poisonings, of whom 59 survived. It found no evidence in 461, insufficient information in 62, and returned 66 as inconclusive2.
Around 400 — cited by government officials by the time of the 2016 trial.
More than 300 — the estimate of the victims’ families, who reject the forensic methodology outright.
Up to 10,000 — claimed by some Panamanian organisations. There is no case series behind it and no stated method. I would treat it as advocacy rather than data, and I would say so in print, because the credibility of the lower numbers depends on it.
None of these figures is a lie. They are different case definitions producing different answers, which is exactly what case definitions are for.
The forensic figure is the rigorous one. But notice what rigour does here: it subtracts. Sixty-six inconclusive and sixty-two with insufficient information means 128 families were told that they cannot be told. The confirmed count is an artefact of how many bodies remained available to test, how quickly they were buried, and who owned the laboratory. In Panama, the entity that manufactured the poison and the entity that adjudicated the cause of death were the same government.
Nineteen years later, in Madhya Pradesh, the cause of a cluster of child deaths stayed elusive for weeks in part because no post-mortems were performed — the parents had not given permission. You cannot confirm what you did not examine.
If you take one operational habit from this piece, take this one. When somebody hands you a confirmed count, ask what had to be excluded in order to confirm it.
The Disease It Pretends To Be
Diethylene glycol itself is relatively inert. Alcohol dehydrogenase oxidises it, and the metabolite that matters is diglycolic acid. In cell work, neither the parent compound nor the intermediate does much to proximal tubule cells; diglycolic acid kills them in a dose-dependent manner. It resembles succinate closely enough to be carried in by the dicarboxylate transporters, it accumulates because it leaves poorly, it stalls the citric acid cycle, ATP collapses, and the tubule dies.
Clinically it runs in three phases: gastrointestinal symptoms with a high anion gap metabolic acidosis in the first day; acute kidney injury at roughly day one to three; and from about day five, cranial and peripheral neuropathy — facial weakness, ascending paralysis, respiratory failure.
Here is the part that matters operationally. It presents as whatever the victim was already plausibly dying of.
In Panama the syrup reached elderly diabetics and the neurotoxic phase dominated. Clinicians reached for Guillain-Barré syndrome, which was a reasonable call for ascending weakness in an older patient. The tell was that the weakness did not keep ascending, and that patients stopped producing urine. What eventually broke the case was not a laboratory. It was a physician noticing more Guillain-Barré in a fortnight than the hospital normally saw in a year.
In The Gambia, Indonesia and Uzbekistan the victims were children under five, the renal phase dominated, and the differential was sepsis or idiopathic acute kidney injury — the two commonest things a small child can be dying of in a low-resource hospital.
Same molecule, opposite clinical picture, because the vector selected the population. There is no single syndrome for a clinician to memorise. That is why the pharmacovigilance signal always arrives last: the poisoning does not look like poisoning, it looks like whatever your ward already sees.
Now the arithmetic, since that is what we do here.
Coldrif assayed at 48.6% weight per volume diethylene glycol — 486 milligrams per millilitre. A single 5 mL paediatric dose therefore delivers about 2.4 grams. The estimated minimum lethal dose is on the order of 1.1 mL per kilogram3, which is roughly 12 grams for a ten-kilogram toddler.
Five doses. Twenty-five millilitres. Less than one bottle, taken exactly as directed, over two or three days.
That lethal dose figure dates to 1937 and it is soft — the human data behind it are thin and the published range is wide. I am telling you that because the error bars are the point rather than a caveat. Even at the most forgiving end of the estimate, a normal therapeutic course kills a small child. There is no misuse scenario here. There is only use.
There are antidotes. Fomepizole, or ethanol, blocks alcohol dehydrogenase and prevents the toxic metabolite forming; haemodialysis clears what has already formed. Both require the poisoning to be recognised inside a window that closes in days, in settings that typically have neither the drug nor paediatric dialysis. By the time anyone knows what they are treating, they are no longer treating it.
2022–2023: The Same Barrel, New Labels
You already have the mechanism, so this section is evidence of repetition rather than a fresh investigation.
The Gambia, October 2022. Four products from a single Indian manufacturer. An acute kidney injury cluster among 78 children; at least 70 dead. The official figure moved from 66 to 70 as the investigation closed4.
Indonesia, November 2022. Domestically produced syrups. Roughly 326 acute kidney injury cases and around 200 deaths5. Court filings later showed that propylene glycol batches used by one manufacturer assayed at 96 to 99 percent ethylene glycol. That is not contamination. That is substitution with a cover story.
Uzbekistan, January 2023. Two products from Marion Biotech. The early figure was 18 to 20 children; the count during the criminal proceedings runs to 65 and beyond6. The president stated publicly that local officials had been concealing the scale.
And then Cameroon, where a syrup assayed at 28.6% DEG was marketed by an English company that the UK regulator confirmed does not exist; Iraq; the Marshall Islands; Micronesia.
The WHO investigated whether a single upstream supplier connected the manufacturers. It did not find one. People keep reading that as a dead end. It is the opposite: six manufacturers across two countries independently arrived at the same failure, because the failure is available to anybody who does not test an incoming drum.
One Indonesian detail belongs in every GMP training deck ever built. Roughly 60,000 bottles carried labels listing only the safe ingredients. The falsification happened upstream of the factory floor. Everybody downstream was reading a document.
The Arithmetic of Consequence
Panama: 26 people charged, 11 prosecuted, 5 convicted — a decade after the deaths. Medicom’s legal representative received five years in prison and a fine of roughly six thousand dollars. Set that against a forensically confirmed toll of 115 and an official one of 400.
Indonesia: the manufacturer’s executives received two years each. The chemical supplier’s people received ten. That ratio tells you where the criminal law believes the crime occurred, and I think the law is broadly right — but note that the pharmaceutical company which failed to test its own incoming material drew a fifth of the sentence handed to the men who sold it. In the civil case, compensation for a dead child was set at 50 million rupiah. Call it €2,800. The families had asked for roughly forty times that.
I am not raising this for outrage. I am raising it because we build risk models for a living.
If the expected cost of shipping untested excipient is €2,800 per fatality, discounted by the probability of detection and by ten years of procedural delay, then the model is functioning exactly as designed. That figure is not evidence of a system failing. It is the system’s stated price.
The Fix Follows the Bodies
After 1937, the Federal Food, Drug, and Cosmetic Act.
After Panama, FDA guidance requiring a diethylene glycol limit test on glycerin, a pharmacopoeial ceiling of 0.10%, and in Europe the 2015 guidelines on formalised risk assessment for excipient GMP under the Falsified Medicines Directive.
After 2022–23, the FDA broadened its guidance to propylene glycol, sorbitol, maltitol and other components it classes as high risk — meaning at high risk of being adulterated, not hazardous in themselves — requiring the limit test on representative samples of each lot of each shipment. India made testing at a government laboratory mandatory for cough syrup from June 2023.
For export.
At the time, the lawyer T. Prashant Reddy, co-author of The Truth Pill, said publicly that the measure did nothing for domestic consumers because it applied only to exports. Journalists put the question to the health ministry directly. There was no answer.
Two years later: Coldrif, 48.6% diethylene glycol7, at least 22 to 24 children dead in Chhindwara and beyond, from a plant later documented with 39 critical and 325 major GMP deficiencies. India’s drug regulator confirmed to the WHO that none of the implicated product had been exported.
Not one bottle crossed a border, because it did not have to. The regulation had drawn a line, and the product simply stayed on the cheap side of it. India has since extended finished-product testing for diethylene glycol and ethylene glycol to the domestic market. It took the children to get there.
This is the mechanism I described in the Factor VIII piece, and it has now completed a full cycle. Regulate the destination market and the harm relocates abroad. Regulate the export lane and the harm turns inward. The hazard is conserved. Only the address changes.
There Is No Second Supply Chain
If you have read this far from an office in Basel, Frankfurt or Boston, there is a comfortable conclusion available at this point, and I would like to take it away from you.
Nothing in this article is a story about poor countries. Glycerin and propylene glycol are commodity chemicals moving on a global market, through the same layer of traders, brokers and repackagers that appears in every case above. A European finished-product manufacturer buys from that market. There is no separate, cleaner one reserved for jurisdictions with functioning regulators.
What has protected Europe and North America is not the address on the invoice. It is that somebody at goods-in actually ran the identity test on the drum that arrived. That is the whole of the difference. One procedural step, performed by a person, on a particular Tuesday, on this consignment.
The EU’s own 2015 guideline on formalised excipient risk assessment is, read honestly, an admission of precisely this. It exists because a marketing authorisation holder cannot see past its immediate supplier and must therefore reason about a chain it does not control. Regulators do not impose formalised risk assessment for problems they consider remote.
Which inverts the geography of everything above. India is not where the hazard originates. India is where the last line of defence most recently failed, and therefore where the failure became visible. In 2006 that location was a government laboratory in Panama. In 1937 it was a laboratory in Bristol, Tennessee.
The distance between a European manufacturer and Sresan Pharmaceuticals is not a border and it is not a GDP figure. It is a limit test — and it has to be run again on the next drum, and the one after that.
Interactive: The Chain of Custody Tracer
Four things, addressed to the people who actually sign for material.
A certificate of analysis is a marketing document until you have run the identity test yourself. Every retyping is a laundering event. In Panama the certificate survived four companies and three countries; the name of the manufacturer did not survive the first.
Count the hops. If you cannot name the entity that physically made your excipient and state its regulatory status, you do not have a supply chain. You have a rumour with an invoice attached.
Qualify excipients the way you qualify actives. We reserve our audit rigour for the molecule that carries the marketing authorisation, and then buy the solvent — which is most of the bottle — on paperwork alone.
Ask what the confirmed count excluded. This applies in pharmacovigilance and in trial safety reporting just as much as it does in a forensic institute. The number that reaches the report is the number somebody was able to adjudicate. The rest are returned as inconclusive, and inconclusive is not the same thing as absent.
Compliance is not a shield. It is a map showing precisely where the shield ends, and everybody who has ever substituted diethylene glycol for glycerin has read that map correctly.
Ninety years. Twenty-five documented incidents. More than thirteen hundred people, most of them very small. We like to say that regulations are written in blood. The more uncomfortable truth is that they are written in blood and then carefully scoped, so that the next batch always has somewhere to go.
Sources and method
This piece is built on primary documents wherever they exist: WHO Medical Product Alerts, the joint WHO and UN Office on Drugs and Crime report on excipient supply chain integrity of July 2025, CDC Morbidity and Mortality Weekly Reports on Haiti and Nigeria, FDA and European Commission guidance, and the pharmacopoeial monographs themselves. The reconstruction of the Panama supply chain rests on the New York Times “A Toxic Pipeline” series of 2007, which remains the definitive account and won the Pulitzer Prize for it.
Death tolls in this field are contested, and I have given ranges rather than picking a number. Where figures diverge it is almost always because institutions applied different case definitions, not because anyone is lying, and the footnotes explain each divergence. Where a widely repeated figure traces back to a single unverified claim, I have said so and kept it out of the argument.
This is an inference rather than a sourced claim: no such incident appears in the documented record, including the WHO/UNODC dataset of twenty-five incidents. Absence from that record is not quite the same as absence, and I would be glad to be corrected. Contaminated material has certainly reached regulated markets since — the argument of this article is that testing at goods-in is what has stopped it, not geography.
This breakdown — 763 candidate cases examined, 174 classified as diethylene glycol poisonings, 59 of them survivors — comes from the Instituto de Medicina Legal y Ciencias Forenses, reported through Associated Press and NBC News coverage in 2007 rather than from the institute's own published report, which I have not been able to obtain. The figures have been consistently repeated since and I have no reason to doubt them, but a reader should know they reach this article at one remove.
This figure originates in work published in 1937, in the immediate aftermath of Elixir Sulfanilamide, and it has been repeated ever since with remarkably little re-examination. The human data behind it are thin and drawn from mass poisonings in which fatal and non-fatal exposures overlapped; the California Poison Control System states plainly that the minimum toxic dose in humans is not known. Animal work suggests a steep threshold rather than a gradual one. I have kept the figure because it is the one in circulation, and built the argument so that it survives the estimate being wrong by a factor of two in either direction.
WHO's alert of 5 October 2022 cited 66; the Gambian police preliminary report gave 69; the government taskforce of July 2023 and a subsequent parliamentary committee settled on at least 70. This is one of the few tolls in this article that converged rather than diverged.
Published figures for Indonesia range from 99 to over 300, which is almost entirely an artefact of two things being counted. The larger number is total acute kidney injury cases; the smaller is deaths; and both rose through late 2022 as the investigation proceeded, so any given report is a snapshot. WHO's Indonesia office stated in March 2023 that over 300 cases had been reported by early February and that more than half had been fatal. Where you see "200+" it is usually deaths, and "300+" usually cases.
The lower figure is what Uzbekistan's health ministry reported in December 2022 and January 2023, and it is the number carried in WHO's alert of 11 January 2023. The higher one emerges during the subsequent criminal proceedings. The divergence is not a correction of an error: President Mirziyoyev stated publicly that local officials had been concealing the scale, which means the early figure is best read as what was being admitted at the time rather than what was known.
The Tamil Nadu Government Drugs Testing Laboratory report of 2 October 2025 is reported as 48.6% w/v in most coverage; at least one later official document gives 46.28%. I have used the higher and more widely cited figure. The difference does not affect the arithmetic in any way that matters — at either concentration a ten-kilogram child reaches the lethal estimate inside a normal therapeutic course — but it is the kind of discrepancy that should be visible rather than quietly resolved.