Dirty medicine
By Katherine Eban
May 15, 2013

1. The assignment

FORTUNE — On the morning of Aug. 18, 2004, Dinesh Thakur hurried to a hastily arranged meeting with his boss at the gleaming offices of Ranbaxy Laboratories in Gurgaon, India, 20 miles south of New Delhi. It was so early that he passed gardeners watering impeccable shrubs and cleaners still polishing the lobby’s tile floors. As always, Thakur was punctual and organized. He had a round face and low-key demeanor, with deep-set eyes that gave him a doleful appearance.

His boss, Dr. Rajinder Kumar, Ranbaxy’s head of research and development, had joined the generic-drug company just two months earlier from GlaxoSmithKline, where he had served as global head of psychiatry for clinical research and development. Tall and handsome with elegant manners, Kumar, known as Raj, had a reputation for integrity. Thakur liked and respected him.

Like Kumar, Thakur had left a brand-name pharmaceutical company for Ranbaxy. Thakur, then 35, an American-trained engineer and a naturalized U.S. citizen, had worked at Bristol-Myers Squibb (BMY) in New Jersey for 10 years. In 2002 a former mentor recruited him to Ranbaxy by appealing to his native patriotism. So he had moved his wife and baby son to Gurgaon to join India’s largest drugmaker and its first multinational pharmaceutical company.

When he stepped into Kumar’s office that morning, Thakur was surprised by his boss’ appearance. He looked weary and uneasy, his eyes puffy and dark. He had returned the previous day from South Africa, where he had met with government regulators. It was clear that the meeting had not gone well.

The two men strolled into the hall to order tea from white-uniformed waiters. As they returned, Kumar said, “We are in big trouble,” and motioned for Thakur to be quiet. Back in his office, Kumar handed him a letter from the World Health Organization. It summarized the results of an inspection that WHO had done at Vimta Laboratories, an Indian company that Ranbaxy hired to administer clinical tests of its AIDS medicine. The inspection had focused on antiretroviral (ARV) drugs that Ranbaxy was selling to the South African government to save the lives of its AIDS-ravaged population.

As Thakur read, his jaw dropped. The WHO had uncovered what seemed to the two men to be astonishing fraud. The Vimta tests appeared to be fabricated. Test results from separate patients, which normally would have differed from one another, were identical, as if xeroxed.

Thakur listened intently. Kumar had not even gotten to the really bad news. On the plane back to India, his traveling companion, another Ranbaxy executive, confided that the problem was not limited to Vimta or to those ARV drugs.

“What do you mean?” asked Thakur, barely able to grasp what Kumar was saying.

The problem, said Kumar, went deeper. He directed Thakur to put aside his other responsibilities and go through the company’s portfolio — ultimately, every drug, every market, every production line — and uncover the truth about Ranbaxy’s testing practices and where the company’s liabilities lay.

MORE: Maker of generic Lipitor pleads guilty to selling ‘adulterated drugs’

Thakur left Kumar’s office stunned. He returned home that evening to find his 3-year-old son playing on the front lawn. The previous year in India, the boy had developed a serious ear infection. A pediatrician prescribed Ranbaxy’s version of amoxiclav, a powerful antibiotic. For three scary days, his son’s 102° fever persisted, despite the medicine. Finally, the pediatrician changed the prescription to the brand-name antibiotic made by GlaxoSmithKline (GSK). Within a day, his fever disappeared. Thakur hadn’t thought about it much before. Now he took the boy in his arms and resolved not to give his family any more Ranbaxy drugs until he knew the truth.

What Thakur unearthed over the next months would form some of the most devastating allegations ever made about the conduct of a drug company. His information would lead Ranbaxy into a multiyear regulatory battle with the FDA, and into the crosshairs of a Justice Department investigation that, almost nine years later, has finally come to a resolution.

On May 13, Ranbaxy pleaded guilty to seven federal criminal counts of selling adulterated drugs with intent to defraud, failing to report that its drugs didn’t meet specifications, and making intentionally false statements to the government. Ranbaxy agreed to pay $500 million in fines, forfeitures, and penalties — the most ever levied against a generic-drug company. (No current or former Ranbaxy executives were charged with crimes.) Thakur’s confidential whistleblower complaint, which he filed in 2007 and which describes how the company fabricated and falsified data to win FDA approvals, was also unsealed. Under federal whistleblower law, Thakur will receive more than $48 million as part of the resolution of the case.

Fortune’s account of what occurred inside Ranbaxy and how the FDA responded to it raises serious questions about whether our government can effectively safeguard a drug supply that last year was 84% generic, according to the IMS Institute for Healthcare Informatics, much of that manufactured in distant places. More than 80% of active pharmaceutical ingredients for all U.S. drugs now come from overseas, as do 40% of finished pills and capsules. (Click here for a list of Ranbaxy products in the U.S.)

2. The dark side of the generics boom

Today’s global market for generic drugs is $242 billion and growing. In America we have embraced generics as a vital way to control costs, a trend likely only to accelerate as health reform extends treatment to millions and our population ages.

Ranbaxy was the first foreign generics manufacturer to sell drugs in the U.S. and rose rapidly to become, today, the sixth-largest generic-drug maker in the country, with more than $1 billion in U.S. sales last year (and $2.3 billion worldwide). The company, now majority owned by Japanese drugmaker Daiichi Sankyo, sells its products in more than 150 countries and has 14,600 employees.

As our dependence on generic drugs from overseas has grown, so have questions about their oversight and safety. A report by the Government Accountability Office found that in 2009, regulators inspected only 11% of foreign drug manufacturing plants, while they inspected 40% of domestic ones.

The FDA has increased its inspections of foreign plants in recent years with a goal of reaching parity with the frequency of domestic inspections. It now has agents based in India and other countries. But even if the frequency were equal, the inspections themselves are not. Due to complex logistics, foreign inspections can last less than a week and allow companies weeks of advance notice, while domestic ones can last up to six weeks and are unannounced. “The reality is that we simply don’t know what we’re dealing with,” says Dr. Roger Bate, an international pharmaceutical expert. “No one has actually gone into these sites to expose what’s going on.”

Fortune’s investigation yields the first comprehensive picture of how one under-policed and far-flung generics company operated. It is not a tale of cutting corners or lax manufacturing practices but one of outright fraud, in which the company knowingly sold substandard drugs around the world — including in the U.S. — while working to deceive regulators. The impact on patients will likely never be known. But it is clear that millions of people worldwide got medicine of dubious quality from Ranbaxy.

The rough outlines of the fraud at Ranbaxy first emerged in a 2008 court filing by the Justice Department. But its extent and depth and the involvement of top company executives have not been previously revealed. Fortune has also uncovered evidence that the company’s misconduct continued well into 2009, even after the FDA restricted the company’s activities.

This account is based on more than 1,000 confidential Ranbaxy documents, including internal reports, memos, e-mails, hundreds of pages of FDA documents obtained through Freedom of Information Act requests, and court records. Fortune interviewed more than a dozen former and current employees, as well as 40 scientists, public health experts, patient advocates, congressional investigators, and regulators.

Ranbaxy declined multiple requests to make representatives available for interviews. Instead the company directed Fortune to a press release it issued on the day of its guilty plea. “While we are disappointed by the conduct of the past that led to this investigation, we strongly believe that settling this matter now is in the best interest of all of Ranbaxy’s stakeholders,” CEO Arun Sawhney stated in the release. “Ranbaxy has successfully launched several generic products recently and is well-positioned for future growth … Our conduct is guided by our philosophy of ‘Quality and Patients First.’ ” (A Daiichi Sankyo spokesperson says, “We cannot respond to [Fortune’s] questions for legal reasons.”)

As the Ranbaxy story makes vividly clear, generic-drug makers intent on breaking the rules — especially those operating abroad — can easily do so. Drug applications work on the honor system: The FDA relies on data provided by the companies themselves. “We depend on that information to be truthful,” Gary Buehler, who headed the FDA’s office of generic drugs for 10 years, said in December 2009. (Buehler has since taken a position at the U.S. unit of the Israeli generic-drug company Teva.) The approval system “requires the ethical behavior of the applicant,” he said. Otherwise, “the whole house of cards will fall down.”

FDA regulators contend that they responded aggressively to the wrongdoing at Ranbaxy. “Based on the evidence we had at the time,” an agency spokesperson writes in e-mailed answers, “FDA acted appropriately within the scope of its authority to protect the public from drugs that failed to comply with federal quality standards.” In 2008 the agency halted the importation of 30 different drugs from two of Ranbaxy’s manufacturing plants in India and invoked a rare Application Integrity Policy, stopping the review of new drug applications from the Paonta Sahib manufacturing site until Ranbaxy proved their truthfulness.

In January 2012 the Justice Department placed Ranbaxy under a sweeping consent decree, describing the action as “ground breaking in its international reach.” The decree prohibited the company from selling drugs in the U.S. that were made at several of Ranbaxy’s Indian manufacturing plants until the quality could be verified. It also required the company to undergo independent auditing.

MORE: Are generics really the same as branded drugs?

For all the actions taken by federal authorities, there is a deeply troubling aspect to the government’s role in the saga of Ranbaxy. Even as ever more details of the company’s long-running misconduct emerged, drug regulators permitted Ranbaxy to keep on selling many of its products.

Indeed, the FDA — charged with protecting the safety and health of Americans — went even further. Despite the agency’s finding of fraud and misconduct, it granted Ranbaxy lucrative rights to sell new generic drugs. In the most high-profile example, in November 2011 the FDA allowed the company to maintain its exclusive first dibs on making the generic version of a medicine taken by tens of millions of Americans: Lipitor. In the first six months, this privilege allowed Ranbaxy to generate $600 million in sales of generic atorvastatin, as nonbranded Lipitor is known.

Should the FDA have been surprised, then, when problems emerged just a year later? In November 2012, Ranbaxy had to recall millions of pills after tiny glass particles were discovered in some of them. Even that, it turns out, was enough for only a temporary suspension, and the FDA permitted the company to resume sales in March.

“The real story is how poorly our government has responded to all of this,” says Vincent Fabiano, Ranbaxy’s former vice president of global licensing. He’s one of a number of former company executives who spoke to FDA or other investigators about the company and then watched in increasing disgust as, for years, nothing seemed to happen. “Still as we sit here today,” Fabiano says, “Ranbaxy is in business in the United States.”


Dinesh Thakur
3. Fistfights and fraud

The company that Dinesh Thakur arrived at in June 2003 was bristling with ambition but had a seat-of-the-pants feel. Fistfights erupted at executive meetings. The vice president of clinical research chain-smoked four packs a day. At the New Jersey manufacturing plant, sensitive pharmaceutical ingredients wound up in the employee refrigerator next to the half-and-half.

In India, Thakur’s job, as director of research information and project management, was to impose some order and transparency on the chaotic global pipeline. Even though Ranbaxy lacked polish, Thakur had no reason to doubt that it made safe, effective drugs.

In August 2004, as he confronted his assignment to investigate possible fraud at his own company, Thakur gave each of his project managers a part of the world and asked them to compare Ranbaxy’s manufacturing data against the claims made to regulators. His own efforts began with a visit to a company regulatory official.

It was a depressing conversation. The official explained, Thakur says, that the company culture was for management to dictate the results it wanted and for those beneath to bend the process to achieve it. He described how Ranbaxy took its greatest liberties in markets where regulation was weakest and the risk of discovery was lowest. He acknowledged there was no data supporting some of Ranbaxy’s drug applications in those regions and that management knew that, according to Thakur. After initially discouraging him, the official grudgingly directed him to begin his inquiry with the Africa portfolio. (The official, who has since left, disputes Thakur’s account, asserting that management launched an investigation because it didn’t know about the misconduct. He says Ranbaxy’s conduct was “checked out” internally at that time, and he shared that information with the company.)

The heart of good manufacturing is documentation. Without it, there is no way to verify quality, investigate problems, or know whether your drug will improve health or harm it. Because the most minuscule changes can make the difference between a robust product and one that degrades and becomes toxic, each step must be recorded and validated. Any misrepresentation, mixing of data streams, or deviation from procedure invalidates — and potentially adulterates — the drugs.

To see how the process is supposed to work, Fortune visited a contract laboratory in Edison, N.J., Celsis Analytical Services, now part of AAIPharma, which helps companies assess whether they’ve met appropriate manufacturing standards. At Celsis, nothing goes untested or undocumented, from who has custody of logbooks to the water used to wash laboratory glassware. Results are recorded in black ink, then audited and verified in red ink. Wite-Out is banned to avoid the chance that someone would try to conceal data. No data are ever discarded, and no test results can be invalidated without triggering an inspection. When it comes to quality, says Mary Kubilus, then Celsis’s director of site operations, “there is no 99%.”

But in Gurgaon, as Thakur’s project managers gathered data and interviewed company scientists and executives, he says, they stumbled onto Ranbaxy’s open secret: The company manipulated almost every aspect of its manufacturing process to quickly produce impressive-looking data that would bolster its bottom line. “This was not something that was concealed,” Thakur says. It was “common knowledge among senior managers of the company, heads of research and development, people responsible for formulation to the clinical people.”

Lying to regulators and backdating and forgery were commonplace, he says. The company even forged its own standard operating procedures, which FDA inspectors rely on to assess whether a company is following its own policies. Thakur’s team was told of one instance in which company officials forged and backdated a standard operating procedure related to how patient data are stored, then aged the document in a “steam room” overnight to fool regulators.

Company scientists told Thakur’s staff that they were directed to substitute cheaper, lower-quality ingredients in place of better ingredients, to manipulate test parameters to accommodate higher impurities, and even to substitute brand-name drugs in lieu of their own generics in bioequivalence tests to produce better results.

After just 10 days of intensive research, Thakur’s team had learned enough to send preliminary information on the Latin American, Indian, and the “rest of world” markets to Raj Kumar, who then compiled the findings into a four-page report for then-CEO Brian Tempest.

MORE: The war over Lipitor

The confidential report laid bare systemic fraud in Ranbaxy’s worldwide regulatory filings. It found that “the majority of products filed in Brazil, Mexico, Middle East, Russia, Romania, Myanmar, Thailand, Vietnam, Malaysia, African Nations, have data submitted which did not exist or data from different products and from different countries …” The company not only invented data but also fraudulently mixed and matched data, taking the best results from manufacturing in one market and presenting it to regulators elsewhere as data unique to the drugs in their markets.

Sometimes all the data were made up. In India and Latin America, the report noted the “non-availability” of validation methods, stability data, and bio-equivalence reports. In short, Ranbaxy had almost no method whatsoever for validating the content of the drugs in those markets. The drugs for Brazil were particularly troubling. The report showed that of the 163 drug products approved and sold there since 2000, only eight had been fully and accurately tested. The rest had been filed with phony data because they had been only partially tested, or not at all.

For its HIV drugs, the report found that Ranbaxy had used ingredients that failed purity tests and blended them with good ingredients until the resulting mix met requirements. Such a mélange could degrade or become toxic far more quickly than drugs made from the high-quality materials required.

In a “private and confidential” e-mail sent to CEO Tempest along with his report, Kumar noted that “it appears that some of these issues were apparent over a year ago and I can not find any documents which sought to address these concerns or resolve the issues …” Kumar emphasized that he could “not allow any information to be used for any dossier unless fully supported by data.” He made it clear that he planned to follow the law.


Ranbaxy CEOs Brian Tempest and Malvinder Singh
4. The race to be first

Just three decades ago, generic drug companies in the U.S. were derided as patent breakers. They had no clear way to gain FDA approval, while brand-name-drug companies had a lock on the market. The 1984 Hatch-Waxman Act changed that. It created a pathway, the Abbreviated New Drug Application (ANDA), which allowed a generic drug company to simultaneously challenge a patent and demonstrate to the FDA that it could make a drug.

In the late 1980s several generic-drug companies were caught fabricating data and bribing FDA officials to gain approval. In the scandal’s wake, the FDA tightened regulations. It required that a company make three large “exhibit” batches to demonstrate that it could dramatically scale up its manufacturing, undergo inspection, and use an independent company to perform bioequivalence tests before an ANDA was approved. The purpose, says David Nelson, who exposed the 1980s scandal as a senior investigator for the House Energy and Commerce Committee, from which he retired in 2009, was to “prevent the systematic submission of false information” to get FDA approval.

The ANDA offered a lucrative reward for the company that risked almost certain litigation by first challenging a patent. If successful, the company got six months of exclusive sales after the patent lapsed, allowing the generics company to charge up to 80% of the brand-name price during that period. After that, other generics companies could jump in, and the price would drop to about 5% of the original price. Being first was the real jackpot. Consequently, first-to-file status became such an obsession that generic-drug company executives camped out in the FDA parking lot to file their paperwork first.

Ranbaxy learned how to game this system, according to former employees. To hasten the pace of its applications, Ranbaxy sometimes skipped a crucial intermediate step. Instead of making three medium-size exhibit batches and testing those for bioequivalence and stability, as required, Ranbaxy tested earlier and much smaller research-and-development batches that were easier to control and less costly to make. In some FDA applications, it represented these as much larger exhibit batches and presented the data as proof. And then there was the ultimate shortcut: using brand-name drugs as stand-ins for its own in bioequivalence studies.

These deceptions greatly accelerated the pace of the company’s FDA applications. They were also a grave public-health breach. Once Ranbaxy got FDA approval, it leaped straight into making commercial-size batches without any meaningful dry runs. The test results on file with the FDA were meaningless, and the drugs Ranbaxy was actually selling on the U.S. market were an unknown quantity, having never been comprehensively tested before.

5. “Look how good this company is!”

In May 2004, three months before Thakur embarked on his research, Dr. Kathy Spreen joined Ranbaxy’s U.S. office as executive director of clinical medicine and pharmacovigilance. A 15-year veteran of Wyeth and AstraZeneca (AZN), she was there to help launch the company’s brand products division, which planned to create new dosages and formulations of existing drugs. Spreen envisioned her job as that of a regulatory coach, to help guide Ranbaxy through the FDA’s intricate system.

At first, the company’s science seemed to exceed her expectations. She had been on the job a few months and was preparing slides for a presentation about the company’s launch of Riomet, a version of the diabetes drug Metformin, when she noticed something remarkable. The data showing the concentration of Ranbaxy’s drug in the bloodstream appeared to match that of the brand name perfectly. “Look how good this company is,” she remembers thinking. “The bioequivalence data is superimposable on the drugs we are modeling.”

About a month later, while comparing the data for Sotret, the company’s version of the acne drug Isotretinoin, Spreen found it similarly superimposable on the brand-name data. That’s when she began to worry. “If it’s too good to be true,” she recalls thinking, “it’s probably made up.”

By definition, data is tricky. Even two batches of the same drug made by the same company at the same plant under the exact same conditions will have slight variations. Test results for a similar or copycat drug made by a different company with a different formula should look different.

With her suspicions aroused, Spreen began asking her Indian counterparts to send underlying data that supported the test results. They repeatedly promised the information was on the way. When it didn’t arrive, she got excuses: It was a “mess”; they’d be “embarrassed.” She recalls begging, “I don’t care if it’s written on the back of toilet paper. Just send me something.” But it never arrived.

MORE: A new plan for creating new drugs

Six other pharma veterans who worked for Ranbaxy in the U.S. as recently as 2010 tell Fortune they found themselves in a corporate culture like nothing they’d ever experienced. Executives approached the regulatory system as an obstacle to be gamed. They bragged about who had most artfully deceived regulators. Until 2005 the company didn’t even have a functioning patient-safety department, and patient complaints piled up in boxes, ignored, uncategorized, and unreported to the FDA as required.

Spreen kept thinking that if only she could explain American regulations more clearly, Ranbaxy’s executives would understand. But no amount of explaining seemed to change how the company did business. When sales of a diabetes drug were sluggish, she says, one executive asked Spreen if she could use her medical license to prescribe the drug to everyone in the company so they could record hundreds of sales. Spreen refused.

When she asked Ranbaxy’s global manufacturing director to send documentation showing that an antibiotic acne gel was made with good manufacturing practices (GMP), he offered to send her an “impressive looking” certificate. To Spreen, it sounded like an offer to have one forged. She tried to explain, “The look of the certificate means nothing to me unless the FDA says it’s GMP.”

On a trip to India in mid-2004 Raj Kumar quietly confirmed to Spreen what she had already come to suspect: that crucial testing data for many of the company’s drugs did not actually exist and submissions to regulators had been forged.

Ultimately, Spreen says she spent more than a year trying in vain to convince senior executives of the vital need to observe regulations before she finally quit in disgust in June 2005. “There was a total lack of understanding,” she says, “of what it meant to be ethical and what it meant to actually protect the patient.” Along with a number of Ranbaxy executives, Spreen was subpoenaed by congressional investigators to provide witness testimony. Reluctantly, she told them her story years ago — but nothing ever came of it.


Ranbaxy lab workers
6. Breaking it to the board

CEO Tempest had assured Kumar that the company would do the right thing. So on an evening in late 2004, several months after assigning Thakur to dig up the truth, Kumar found himself before five members of the scientific committee of the board of directors, including Tempest and the chairman of the board.

Kumar had a PowerPoint presentation of 24 slides. It made clear that Ranbaxy had lied to regulators and falsified data in every country examined in the report. “More than 200 products in more than 40 countries” have “elements of data that were fabricated to support business needs,” the PowerPoint reported. “Business needs,” the report showed, was a euphemism for ways in which Ranbaxy could minimize cost, maximize profit, and dupe regulators into approving substandard drugs.

No market or type of drug was exempt, including antiretrovirals purchased by the U.S. and WHO as part of a program to fight HIV in Africa. In Europe, for example, the company used ingredients from unapproved sources, invented shelf-life data, tested different formulations of the drug than the ones it sold, and made undocumented changes to the manufacturing process.

In entire markets — including Brazil, Kenya, Ethiopia, Uganda, Egypt, Myanmar, Thailand, Vietnam, Peru, and the Dominican Republic — the company had simply not tested the drugs and had invented all the data. Noting Ranbaxy’s agreement to manufacture brand-name drugs, a slide stated, “We have also put our partners (Bayer & Merck (MRK) in Mexico and in South Africa) at risk by using suspect data.”

Kumar proposed a drastic course: pull all compromised drugs off the market; repeat all suspect tests; inform regulators of every case of switched data; and create a process for linking the right data to the right drugs. As the PowerPoint stated, “A short-term loss of revenue is better than a long-term losing proposition for the entire business.”

Kumar completed the presentation to a silent boardroom. Only one director, a scientist, showed any surprise about the findings. The others appeared more astonished by Kumar’s declaration that if he was not given full authority to fix the problems, he would resign.

The silence told Kumar everything he needed to know.

Within two days of the board meeting, he submitted his resignation: “… given the serious nature of the issues we discussed,” he wrote, his only choice was to withdraw “gracefully but immediately.” He had been at Ranbaxy less than four months.

Kumar confirmed this account of the board meeting and in a statement noted that “support and desire to put things right, from my senior management team, the CEO, the Board of Directors and Chairman of the Board, was not forthcoming. This made my position untenable and I had no option but to resign.” When reached by phone in September 2010, Tempest declined to comment. Citing a busy schedule, he said, “I think it’s best we close the conversation.” (Tempest did not respond to multiple messages in recent weeks.)

On Nov. 9, 2004, just days after the board meeting, it appeared to the outside world that Ranbaxy had made a strong commitment to quality. It withdrew from the WHO prequalified list all seven of its ARV drugs tested by Vimta Labs and pledged to retest and resubmit them. The move even won praise from some AIDS advocates who believed Ranbaxy had tackled the problem of a rogue contractor, Vimta, head on. But inside the company, as events would make clear in the following months, the executives had decided against disclosing any further problems. (In an e-mail, Vimta’s technical director, Harriman Vungal, says the studies it performed for Ranbaxy were “carried out as required” and “were not intended for submission outside India. Ranbaxy, on its own, had submitted to other countries and Vimta was unaware of what was submitted to WHO or others.”)

Thakur remained behind. But with Kumar’s departure, he had lost his protection. Three months after the board presentation, the company’s internal auditors arrived at his department for what they called a routine review. They stayed for 10 weeks, combing through his department’s books and interviewing staff. In late April the company accused him of browsing porn sites from his office computer.

Thakur vehemently denied doing so. Furious, he got his network administrator to pore through the computer records and found that the corporate IT department had logged in to his division’s servers and planted his IP address on several searches, Thakur asserts. On April 24, 2005, Thakur says, he presented Ranbaxy with evidence of computer tampering and submitted his resignation. He was done — or so he thought.

7. “The last thing we want is another inspection …”

By 2005, from a distance, Ranbaxy’s ascent appeared unchecked. But inside the company, the incident of fraud at Vimta was like a teetering domino, threatening to topple hundreds of the company’s drug applications worldwide. Not only had Thakur’s team exhumed fraudulent filings, but goodwill groups and government regulators had become suspicious. They were asking for underlying data for a number of the company’s drugs beyond those tested by Vimta.

The problem confronting Ranbaxy executives was almost unsolvable. Much of the raw data didn’t match what the company had filed with regulators. It either didn’t exist, didn’t make sense, or had been fabricated. A refusal to share it would trigger further suspicion, which left company executives with two bad options: come clean, which could have disastrous consequences, or lie more.

This Catch-22 played out in a torrent of confidential e-mails obtained by Fortune, in which panicked and angry executives scrambled to contain the fallout. They copied Tempest and the future CEO, Malvinder Singh, on many of these e-mails. Now executive chairman of hospital network Fortis Healthcare, Singh declined multiple requests to be interviewed for this article. A spokesperson, Raghu Kochar, e-mailed a comment on Singh’s behalf: “All suggestion of impropriety or misconduct in your queries is denied and rejected.”

In February 2005 a Ranbaxy regulatory affairs executive wrote to colleagues regarding the company’s application to sell the antibiotic cefuroxime axetil in Spain: “Please advice [sic] the way forward. This dossier was scheduled to go in Dec., 04. We have been waiting for your response for the last 2 months. We need to conclude this ASAP …”

This e-mail triggered a terse reply from a company scientist. “During our discussion in Gurgaon on 27th Jan., I mentioned clearly that the data in our Archives and that of the filed one is Differing Entirely. So, I cannot send the data.”

MORE: Japan: Where medical miracles are waiting to get out of the lab

By 2005, the applications of 22 high-priority products needed routine updates in at least one country. All had been made at the Dewas manufacturing plant south of New Delhi and none had been tested adequately. “Data is not available for any of the products,” the head of the stability group at Dewas wrote in an e-mail on which he cc’ed Tempest. One executive responsible for Europe objected strenuously to the filing of false data and wrote to colleagues, “I do not intend spending a stint in a European prison …”

As part of the new plan, Ranbaxy decided to move all manufacturing for U.S. drugs and HIV medications for the PEPFAR program from the troubled Dewas plant to the newer Paonta Sahib facility in the hope that by severing links to the past fraudulent manufacturing — and beginning to submit legitimate data on this group of drugs — regulators would not detect the past misbehavior.

Publicly, company executives spun the change as a response to big American demand. “We have changed the site of manufacture of the product from Dewas to Paonta Sahib facility to facilitate handling high business requirements,” a Ranbaxy executive wrote to a Unicef official on Jan. 8, 2005, explaining the shift for an AIDS drug.

But four days later, as the company prepared to resubmit its ARV data to WHO, the company’s HIV project manager reiterated the point of the company’s new strategy in an e-mail, cc’ed to CEO Tempest. “We have been reasonably successful in keeping WHO from looking closely at the stability data in the past,” the manager wrote, adding, “The last thing we want is to have another inspection at Dewas until we fix all the process and validation issues once and for all.”

8. “It’s just blacks dying.”

Throughout the summer of 2005, Thakur tried to convince himself that the company’s medicine was no longer his problem. He was jobless and piecing together haphazard consulting work. He feared for his family’s safety. The company had a “reputation for threatening people, bullying people,” he recalls. Thakur hired a security company, which posted a guard outside his home 24 hours a day.

On fitful nights, he lay awake with a map of the world in his head. It contained each of Ranbaxy’s markets and the substandard drugs the company had made. He mentally reviewed the graphs he had prepared, each spelling out a hazard to patients that was almost certainly continuing. Not only had the FDA approved the company’s PEPFAR drugs. In August, the WHO restored the company’s ARVs to its prequalified list.

Thakur knew the drugs weren’t good. They had high impurities, degraded easily, and would be useless at best in hot, humid conditions. They would be taken by the world’s poorest patients in sub-Saharan Africa, who had almost no medical infrastructure and no recourse for complaints. The injustice made him livid.

Ranbaxy executives didn’t care, says Kathy Spreen, and made little effort to conceal it. In a conference call with a dozen company executives, one brushed aside her fears about the quality of the AIDS medicine Ranbaxy was supplying for Africa. “Who cares?” he said, according to Spreen. “It’s just blacks dying.”

On Aug. 15, four months after resigning from the company, Thakur opened a Yahoo e-mail account and wrote under a pseudonym to top regulators in the U.S., Britain, the WHO, and Brazil. Posing as a company scientist and using broken English, he claimed that Ranbaxy was forcing him to falsify data. He got no reply. The letter was not nearly authoritative or detailed enough to penetrate the system.

Finally he wrote directly to FDA commissioner Lester Crawford and alleged that Ranbaxy was selling “untested, spurious, ineffective medication.” He added, I “plead with you to put a stop to this crime.”

Edwin Rivera-Martinez, then chief of investigations and preapproval compliance in the FDA’s center for drug evaluation and research, wrote back and asked if Thakur would consent to a conference call. Thakur had initially hoped to set regulators on the trail but limit his own involvement. Reluctantly, he agreed.

To Thakur, the wrongdoing was black and white. He had given proof and expected action. But 10 days after the conference call, the FDA announced that it had approved Ranbaxy’s application for the first pediatric-AIDS drug for the U.S. market, Zidovudine. “Given all the data you have in your possession today about the criminal activities of this company in registering ARVs with fabricated data, I am confused how the USFDA could give such an approval,” Thakur wrote to Rivera-Martinez. The bureaucrat wrote back that because the drug had been approved before Thakur made contact, only actual proof of fraud could reverse the decision.

Though Thakur didn’t know it at the time, the FDA had found his information credible and was moving to confirm it. In October 2005, less than two months after his first contact, Rivera-Martinez’s division sent a request to the division of field investigations to perform high-priority inspections at Dewas, Paonta Sahib, and Ranbaxy’s manufacturing division for raw ingredients, Matrix Labs. The memorandum recommended that the inspectors collect any documents on the day they requested them, since the “informant said that the firm has fabricated documents overnight during inspections.”

MORE: Novartis CEO Joe Jimenez lays out his path to business longevity

The agency needed an unvarnished look at the company. But as was standard for an overseas inspection, it notified Ranbaxy almost three months in advance that it was coming. In January 2006, Thakur urgently relayed to Rivera-Martinez what he had learned from former colleagues: The senior leadership of the company was “camped out in the plant locations, both at Paonta Sahib and at Dewas,” he wrote. “There is a massive cover-up effort underway to ‘produce’ ” documentation that agency inspectors might request.

A team of FDA inspectors arrived at Paonta Sahib on Feb. 20, 2006, and stayed for five days. When they had last visited, in December 2004, without the benefit of inside information, the result had been a clean bill of health. This time, they knew where to look, and what they found was disturbing: Raw data was routinely discarded; the company’s standard operating procedure approved the discarding and disregarding of data; patient complaints went uninvestigated; and stability testing was a shambles.

During stability testing, drugs are placed in chambers that resemble big refrigerators that can replicate different climates, and then they are tested at intervals to see when and how the drugs’ ingredients break down. At Paonta Sahib, inspectors found stability chambers full of stray drug samples but no logbooks identifying the contents or the dates of when they were entered or tested. The inspectors also took and tested samples of Sotret, Ranbaxy’s version of the acne drug Accutane, and found that it degraded far in advance of its expiration date.

The findings were serious. Four months later in a warning letter, the FDA said that it would not consider any new applications for drugs made at the site until the company could demonstrate corrections. But that did nothing to stop all the drugs that were already on the market, drugs that had been approved, or applications submitted from other sites. Rivera-Martinez sounded almost plaintive when he wrote to Thakur that spring: “We are under a lot of pressure to approve Ranbaxy’s generic version of Pravastatin [a cholesterol-lowering drug] when the patent exclusivity runs out this Thursday.”

It had been nine months since Thakur had first contacted the agency. He had watched as Ranbaxy got six new approvals. The FDA agent who had taken charge of his case tried to ease his frustration. “Imagine, if you will, that we were able to prove even half of what you have told us,” she wrote to Thakur. “This would bring down the entire corporation. One of the largest in the world.” She added, “To lose on a technicality would be a crime in itself.”

Thakur wrote back, “It makes me wonder if all my efforts and troubles were worth anything at all.” His FDA handler urged him not to lose hope. “The wheels of justice turn slowly,” she wrote, “but they do turn.”

9. The Great Valentine’s Day Raid

On Feb. 14, 2007, Vincent Fabiano was at his desk at Ranbaxy’s U.S. headquarters in Princeton, N.J., when a man he had never seen before walked into his office. “Who the hell are you?” Fabiano asked. “I’m an FDA criminal investigator,” the man said. Fabiano noticed the gun on the man’s hip and stepped away from his desk as directed.

The building was surrounded by police cars, and panic was spreading. “People were freaking out, crying,” recalls a former employee. “They took every computer. There were people with guns.” Employees called the search warrant the Great Valentines Day Raid.

As the news ricocheted from New Jersey to New Delhi, Ranbaxy issued a statement: “This action has come as a surprise. The company is not aware of any wrongdoing. It is cooperating fully with officials.”

At the House Energy and Commerce Committee, which oversees the FDA, senior investigator David Nelson learned of the search warrant and immediately called the legislative office at the FDA. “What’s going on?” he asked. “We can’t tell you,” came the response.

“The hell you can’t,” he snapped. “Your first obligation is to public health.” But after what Nelson says were assurances from an assistant commissioner that the search warrant did not relate to drug quality or manufacturing, he assumed the issue was accounting fraud and put the matter aside.

The criminal investigation was humming. Ranbaxy executives were stopped in transit at American airports and questioned. The U.S. Attorney’s office issued subpoenas, and the FDA tested close to 100 samples of Ranbaxy drugs.

Thakur, too, was immersed. But the deeper he got, the more worried he became about his legal jeopardy and the safety of his wife and children in India. He had no lawyer and little protection. Finally, in March 2007, almost two years after he first contacted the FDA, he learned of an organization that helps secure legal representation for whistleblowers.

Soon afterward, Thakur obtained a lawyer and deepened his level of involvement still further. He legally became a whistleblower — the technical term is “relator” — in the case against Ranbaxy and thus became eligible for up to a third of the government’s financial recovery. “Up until that point,” he says, “I had no idea what a whistleblower was.”

10. Ranbaxy’s new leadership

In January 2006, Malvinder Singh, the founder’s grandson, succeeded Brian Tempest as Ranbaxy’s managing director and CEO. At 33, with an MBA from Duke University, Singh was brash and competitive. The Indian business press dubbed him the Pharaoh of Pharma, and hailed him as an “out-of-the-box decision-maker.”

Others viewed Singh as petulant and immature. “I want profit!” he would yell in meetings, two former employees recall. Among the staff, he was known for being preoccupied with his ranking on the Forbes list of India’s 40 richest people. When he and his brother Shivinder fell from No. 9 in 2004 to No. 19 in 2005, despite $1.6 billion in assets, Singh seemed to blame the decline on a lack of employee loyalty, a former employee recalls.

His biggest problem was the FDA’s decision not to accept new applications from the Paonta Sahib plant. Ranbaxy desperately needed a green light there. So in November 2006, Singh led a delegation to FDA headquarters to try to reverse the decision.

Up to that point, the company had hardly been conciliatory. When FDA inspectors had discovered the standard operating procedures that allowed for the discarding and disregarding of data, Ranbaxy blamed semantics. It wrote to the FDA, “We now understand the negative connotation that these words may have conveyed, but we can assure you” the company had “never thrown away or ignored” any data. Ranbaxy even disparaged the agency’s science, claiming that FDA test results showing that Sotret degraded more quickly than stated were due to the FDA’s inaccurate testing method. (Years later, in its 2013 guilty plea, Ranbaxy would admit that Sotret was one of the adulterated drugs it had sold.)

Singh and his team presented new quality-improvement plans to skeptical regulators. Unmoved, the regulators refused to lift the stay and upped the ante, asking Ranbaxy to turn over audits done by its outside consultant, Parexel, which the company was claiming were confidential. The meeting ended in a standoff.

On June 11, 2008, Singh stunned the Indian business world by announcing that he and his brother were selling their 34% stake in Ranbaxy to the Japanese drugmaker Daiichi Sankyo for $2 billion. Overall, Daiichi Sankyo shelled out $4.6 billion to take control of the company. Singh agreed to stay on for five years as CEO. Some in the Indian press portrayed the sale to a foreign company as a betrayal of national entrepreneurial pride. But it seemed Singh was cashing out at a propitious moment.

Three weeks later, the U.S. Attorney’s office in Baltimore filed a motion in U.S. district court demanding that Ranbaxy hand over the Parexel audit documents. It alleged that the violations at Paonta Sahib “continue to result in the introduction of adulterated and misbranded products into interstate commerce with the intent to defraud or mislead.”

On Capitol Hill, David Nelson was enraged. Despite the FDA’s reassurances to the contrary, the case was all about drug quality. The FDA had “deceived the committee,” he says. Furthermore, if the drugs were an ongoing threat, why hadn’t the FDA stopped Ranbaxy from selling them?

By mid-July, the saga had reached new heights. Congress had begun investigating the FDA. The inquiry, by the House Energy and Commerce Committee’s subcommittee on oversight and investigations, focused on the agency’s alleged inaction. The new FDA commissioner at the time, Dr. Andrew von Eschenbach, defended the agency, explaining that the FDA had not stopped the drugs because the samples it had tested met specifications. But that wasn’t exactly true. The agency’s own testing had shown that Sotret degraded far more rapidly than the company claimed.

Everywhere the FDA had looked, its inspectors found fraud. Four months earlier, at a unit of Paonta Sahib, agency investigators discovered that supervisors who had supposedly overseen critical manufacturing steps weren’t even at the plant on the days they signed off on the tests. “The culture of the company was corrupt to its core,” says Nelson.

As congressional investigators turned up the heat, the agency finally cracked down. In September 2008, it announced it was restricting the import of 30 drug products made by Ranbaxy (11 of which had been approved after Thakur’s first contact with the FDA three years earlier). The agency still did nothing to recall the very same drugs on pharmacy shelves all over America, despite finding that Ranbaxy had committed fraud on a massive scale.

Nelson says that under FDA rules, the agency should have required Ranbaxy to recall every one of its drugs and resubmit every application. “Why [should] this company, of all companies, be exempted from normal FDA policies?” he asks. “There’s something here that just reeks.”

As Ranbaxy’s stock fell and questions loomed about the company’s integrity, the deal with Daiichi Sankyo hung in the balance. Two months earlier, Malvinder Singh had gone on the attack. On a conference call with reporters in July, he depicted the company as the victim of corporate saboteurs. “A multinational and a leading Indian company are working in concert to bring our share price down,” he said, without specifying the names. Despite the investigation, he said, “our business in the U.S. continues as normal.” Daiichi Sankyo knew of the issues during its due diligence, he said, adding, “There is no change in the deal, and there is no exit clause in it.”

The deal was on track. Did Ranbaxy level with its acquirer about what was going on? Tsutomo Une, Daiichi Sankyo’s global strategy chief, who declined to address questions about Ranbaxy’s manufacturing problems in a March 2010 interview with Fortune, said he didn’t feel misled by Ranbaxy. As he put it, “I never thought that we were fooled.”

11. What’s in the suitcase?

For years, many of Ranbaxy’s senior executives were expected to do what seemed like a small favor when they traveled to India: carry suitcases full of brand-name drugs that they were told were needed for research and development. At Ranbaxy’s U.S. headquarters, suitcases were kept packed with drugs and waiting for the next traveler to India. To some executives, this seemed like a minor shortcut, possibly to cut shipping costs, avoid quarantine, or speed delivery.

Generic-drug companies often study small amounts of a brand-name product in order to reverse-engineer it or to reference it as a point of comparison in applications. But proper channels for purchasing and transporting such drugs are well established and have become “ironclad” since the 2001 passage of the Patriot Act, according to an independent quality-assurance expert.

At Ranbaxy, top executives skirted these regulations and sometimes oversaw the secretive ferrying of drugs, at the very moment when the company faced deadlines to resubmit data to regulators. Fortune was unable to conclusively determine what the suitcase drugs were used for. Some former employees suspect that the company used the brand-name drugs as a substitute for its own in testing (as employees had seen in previous instances), in order to generate pristine data showing how closely Ranbaxy’s drug matched the brand it was seeking to replicate.

Whatever the purpose, what’s clear is that some Ranbaxy staffers strenuously resisted being used as drug mules. In May 2004 a regulatory project manager refused to take French name-brand samples to India. He protested in an e-mail, “I will NOT be bring [sic] any samples with me, not only I believe is this company policy but I personally do not feel comfortable bringing samples in this manner.”

An executive pushed back: “It is critical that the samples are carried by you. We cannot delay it.” The employee flatly refused.

Malvinder Singh, then the company’s worldwide head of pharmaceuticals, got involved. Through his secretary, he asked who would be taking charge of the samples and when they would reach Gurgaon. This triggered a response from the company’s vice president for Europe: “Dear Malvinder, I need to explain to you how labour laws work within Europe. As taking these samples to India is in principal illegal we cannot force people to do so … Normally however we find our people willing to take the risk.”

So important was this to the company’s business that the European vice president then went on to make an extraordinary suggestion to Singh: that CEO Tempest “and yourself have been passing through the U.K. on a regular basis and I would ask you to in future also make yourself available for carrying samples back.” (Ultimately, another employee was found to carry those particular samples.)

In general, those who carried the drugs for Ranbaxy were given a letter claiming the products were for research and development and had no commercial value. This wasn’t true. In June 2004, one executive got stopped by Indian customs with hundred of packs (worth thousands of dollars) of an antinausea drug, Kytril, that he hadn’t declared. The drugs were seized, according to internal e-mails. In one, a Ranbaxy executive noted that this was “an illegal way of bringing the medicine in to India.”

The illicit drug runs continued well after the company had pledged to the FDA that it would operate squarely within regulations. From 2007 to 2008 alone, 17 executives from the New Jersey office took undeclared drugs through Indian customs, four of them multiple times, according to a document given to the FDA.

In February 2009, a lawyer in the regulatory division at Ranbaxy’s New Jersey headquarters got wind of an even more suspicious incident. Some months before, Ranbaxy had agreed to retest its troubled Sotret formulation and submit new data to the FDA. The executives promised the FDA that Ranbaxy would be entirely transparent in the process. In October 2008 the company purchased 12 boxes of a generic acne drug, isotretinoin, made by a competitor. Because of the drug’s dire potential side effects, including birth defects if taken while pregnant, its sale is highly controlled under an FDA program called iPledge. All sales, expiration, and destruction of the drug must be reported.

The more the lawyer probed, the more concerned he became. He learned that a Ranbaxy senior director had overseen the medicine’s unreported purchase from a pharmacist, who had dropped off the boxes at an employee’s house. Another employee had hand carried the drugs to London, where one of the company’s most senior regulatory executives — whose job involved making sure that the company followed all regulations — brought them to India in a suitcase.

When the lawyer reported the incident to the company’s top U.S. executives, they told him to drop the matter. Remaining deeply uneasy, in March 2009, he wrote a memo to file, which Fortune obtained, documenting the incident. The company had not only violated the iPledge program, he wrote, but also had “likely violated U.S. Export Laws, U.K. Import and Export Laws and possible Indian Import Laws.”

Not long after Ranbaxy purchased the isotretinoin, the company submitted its new data to the FDA, which approved it. Within a year the company was forced to start recalling its Sotret again because the drug was degrading faster than it was supposed to — the very problem that had been occurring before.

12. Ranbaxy today: A reformed company?

In February 2009 the FDA punished Ranbaxy anew, labeling the company with the drug regulator’s version of a scarlet “A”: The agency imposed a so-called Application Integrity Policy. That meant a dramatic shift in the regulatory dynamic. No longer would the FDA have the burden of proving fraud if it wanted to block a Ranbaxy product. The onus had flipped, and now the company would have to prove its products weren’t fraudulent in order to get them approved.

The AIP, which had previously been brought against drug companies only a handful of times in FDA history, covered all products manufactured at Ranbaxy’s Paonta Sahib facility. The action left no doubt as to the depth and extent of the problem. The stock market responded accordingly. Ranbaxy shares fell 18% and took Daiichi Sankyo’s down 9% with them. Facing a market disaster in the U.S., the corporate parents were clearly no longer sanguine about Ranbaxy’s management. Within three months, Malvinder Singh stepped down as CEO. A Daiichi Sankyo spokesperson told the press at the time that the leadership change “strengthens Daiichi Sankyo’s part” in Ranbaxy’s management.

At its U.S. headquarters, the warning letters kept coming. In December 2009 the FDA issued one for a manufacturing plant in Gloversville, N.Y., with alarming findings like unexplained black particles in drugs that the company released into the market. “It is apparent that Ranbaxy’s attempts to make global corrections after past regulatory actions by the FDA have been inadequate,” the agency wrote.

Ranbaxy and the government had begun legal haggling to resolve the company’s misdeeds. Inside Ranbaxy, with the generic-Lipitor launch in potential jeopardy, nervous executives mapped out different scenarios that could result from various FDA decisions.

The government seemingly had a trump card in the negotiations — the final approval for Ranbaxy to sell generic Lipitor. Yet it seemed unable to bring a swift resolution to the process, as the company appeared to play for time. The FDA first sent a draft of the consent decree to Ranbaxy in August 2010, according to a document sent by an FDA lawyer. Six months later, Ranbaxy’s lawyers responded, asking for revisions. In a letter to Ranbaxy’s lawyers three months after that, an FDA attorney sent further revisions and tried to bring an end to the process, stating, “We believe this response reflects FDA’s final position and look forward to Ranbaxy’s prompt response which, in our view, should suggest only minor proposed revisions.”

It would be eight more months, until January 2012, before the Justice Department announced the consent decree — and then another 17 months of wrangling between armies of lawyers before the case ended on May 13.

Well before the final resolution, in November 2011, the FDA gave its final blessing for Ranbaxy’s version of Lipitor. Asked about the decision to allow Ranbaxy to make Lipitor after its misconduct at two plants was revealed, an FDA spokesman asserts that the agency is required to evaluate a drug application on a “facility-specific basis.” The company’s “data integrity problems,” he says, occurred at facilities different from where its generic Lipitor is manufactured. That’s true — but it leaves out the fact that Ranbaxy originally applied to make Lipitor at one of its Indian facilities, which was then blacklisted by the FDA. The agency permitted the company to make a significant shift in its application: to switch the plant at which it would make the generic Lipitor. Ranbaxy now proposed making the drug in the U.S. at a facility that was not under FDA investigation.

Last November, Ranbaxy was back in the headlines with some very unwelcome news — the company had detected tiny glass particles in its Lipitor. It had to recall millions of pills and temporarily halt production. Says the FDA spokesperson, “The fact that there were some quality problems that led to a limited recall of the generic product was not a result of the approval process or how it was handled.”

Throughout this time, Thakur — who had initially gotten impatient when the FDA didn’t take action within days — watched in agony as years ticked by. He had launched his own consulting firm, which grew to 300 employees. As always, he tried to lose himself in his work, but he was in a perpetual state of anxiety, with thoughts of the case never far away. There was “a lot of hardship” is all he’ll say about it today.

Remarkably, Ranbaxy is in a stronger position now in the U.S. than it was before its entanglement with the FDA. By the end of 2012, it was the fourth-fastest-growing pharmaceutical company in the U.S., both by sales and number of prescriptions. Much of this growth can be attributed to sales of its generic Lipitor. (That momentum stalled after the recall and the entry of new competitors selling that medication.) Ranbaxy has survived one disaster and punishment after another. As one incredulous employee put it, “We don’t know why we’re still in business.”

The congressional inquiry into the FDA petered out over the years. But under the direction of David Nelson, investigators interviewed the FDA inspectors who went to Paonta Sahib and asked them a simple question: Would they feel comfortable taking Ranbaxy drugs? “Every single inspector that went to India said they would never take a Ranbaxy drug,” says Nelson, “like eight out of eight.”

They were not alone. One by one, each of the former Ranbaxy executives Fortune interviewed had determined, while still at the company, to stop taking Ranbaxy drugs.

In April 2010, Ranbaxy issued another in a mounting series of recalls, this time for a pediatric antibiotic of amoxicillin and clavulanate potassium. In a statement, a Ranbaxy spokesman said that while the company’s own testing found the drug to be within specification, “the company has decided to recall all the lots in question as a matter of caution, given its commitment to the health and safety of patients.” The oral suspension turned brown, instead of white, on being mixed. It was the same drug that Thakur had given his feverish young son, with no effect, seven years earlier.

Reporter associates: Doris Burke and Frederik Joelving