On 23 October 2026, the US Court of Appeals for the Federal Circuit refused to let insulin pump maker Insulet keep its worldwide injunction against South Korean rival EOFlow while Insulet takes its trade secret case to the US Supreme Court. Just days earlier, the same court had turned down Insulet's request to rehear the case. A jury had found that EOFlow misappropriated four Insulet trade secrets, starting with the CAD files for the Omnipod pump, and awarded about 452 million dollars. The appeals court threw the verdict out for one reason: Insulet sued too late.
The case, Insulet Corp. v. EOFlow Co., is now one of the clearest lessons in US trade secret law for engineering companies. The court did not say the jury was wrong about what happened to the files. It said that Insulet knew, or should have known, enough to sue more than three years before it filed, so the claim was barred by the three-year limit in the federal Defend Trade Secrets Act (DTSA).
The uncomfortable part is how ordinary the warning signs were: a senior engineer joining a competitor, a lookalike product at a trade show, a few internal emails. Here is what the court found, what the October rulings change, and what to do so that a strong case is not lost to the calendar.
TL;DR: Insulet v. EOFlow, October 2026
A jury found that EOFlow misappropriated Insulet's Omnipod CAD files, design history file, soft cannula know-how and occlusion-detection algorithm, and awarded 170 million dollars in compensatory and 282 million dollars in exemplary damages, later cut to 59.4 million dollars plus a worldwide injunction. On 28 May 2026, the Federal Circuit reversed 2-1 because Insulet filed suit in August 2023, more than three years after it knew a former engineer worked for EOFlow and had seen a very similar product. In October 2026 the court denied rehearing and refused to keep the injunction in place during a Supreme Court appeal. The lesson: the limitation clock can start with a resignation and a trade show photo. Investigate fast, and keep file-level evidence of who had which CAD files.
What happened between Insulet and EOFlow?
Insulet, based in Massachusetts, makes the Omnipod, an adhesive, wearable insulin patch pump first marketed in 2005, followed by the Omnipod Eros in 2011. EOFlow, a South Korean company, developed its own patch pump, the EOPatch. Its second-generation EOPatch 2 was later sold in Europe and South Korea.
According to the appeals court's summary of the trial evidence, EOFlow hired several former Insulet employees who had signed confidentiality agreements. One of them, Insulet's former Director of Mechanical Engineering, worked as a consultant for EOFlow and, between March and May 2018, shared CAD files for the Omnipod Eros, information about how the Omnipod's soft cannula is designed and made, and information about its occlusion-detection algorithm. One asserted trade secret was defined as the CAD files for the Omnipod, including a single named top-level assembly file.
Insulet sued on 3 August 2023 in federal court in Massachusetts, a few months after Medtronic had announced a plan to buy EOFlow for about 738 million dollars. Medtronic called off that deal in December 2023, citing unspecified breaches of the agreement. In December 2024, the jury found that EOFlow misappropriated four trade secrets, three of them wilfully and maliciously, and that none of the claims were time-barred. It awarded 170,000,015 dollars in compensatory damages and 282,000,005 dollars in exemplary damages.
Because a worldwide permanent injunction overlapped with the damages, the trial judge reduced the award to 25.8 million dollars in compensatory and 33.6 million dollars in exemplary damages. The April 2025 judgment barred EOFlow from selling any product designed, developed or manufactured using the trade secrets anywhere in the world and ordered it to assign certain patent applications to Insulet.
Why did the Federal Circuit throw out the verdict?
Under the DTSA, a claim must be brought within three years after the misappropriation is discovered or, by the exercise of reasonable diligence, should have been discovered. Insulet filed on 3 August 2023, so the critical date was 3 August 2020. In its opinion of 28 May 2026, the majority (Judges Dyk and Reyna) held that the undisputed evidence showed Insulet had enough facts before that date to plead its claim. Judge Prost dissented.
The court applied an access-plus-similarity test. A company can state a trade secret claim when it knows a competitor had access to its secrets, for example through a former employee, and that the competitor's product is similar. On access, the court pointed to an internal Insulet email from 15 March 2019 noting that the people running EOFlow and their designer were former Insulet staff.
On similarity, the evidence went back to June 2018. At the American Diabetes Association conference that month, EOFlow displayed EOPatch 2 samples, some in a clear case. One Insulet employee emailed management: "EOFlow has cloned our product." Others wrote that it looked almost identical to the Omnipod. Insulet staff visited EOFlow's website 20 times after the show, Insulet's deputy general counsel attended the 2019 conference, and EOFlow's Korean IPO prospectus, public by 16 July 2020, showed the drive mechanism and cannula.
Insulet argued it could not know about the misappropriation until it could see inside a product and compare exact dimensions, which are in the CAD files but cannot be measured from a sample. The court rejected that: "detailed knowledge of all of the relevant facts underlying the misappropriation is not required." What counted was whether Insulet could state a claim, not prove one.
Why did one late claim sink all four trade secrets?
The DTSA says a continuing misappropriation is a single claim. The court read that to mean the first discovered or discoverable misappropriation starts the clock for related secrets disclosed by the same person, in the same period, for the same purpose. Because the CAD files, cannula know-how, design history file and algorithm were all allegedly passed on by the same consultant in spring 2018 to design the EOPatch 2, they shared one accrual date.
That mattered most for the occlusion-detection algorithm, which is not visible in any product. Insulet could not have seen it at a trade show. It did not matter: once Insulet had reason to sue over the visible features, the clock ran for the hidden ones too. Judge Prost's dissent argued that the majority reweighed evidence that should have been left to the jury and warned against forcing companies into a premature rush to court.
What changed in October 2026?
Insulet's quarterly report says it filed its petition for rehearing on 29 July 2026. Law360 reported on 19 October that the Federal Circuit had denied it. Then, as Law360 reported on 23 October, the court denied Insulet's request to keep the injunction against EOFlow in place while Insulet appeals to the US Supreme Court. The court had already extended a partial stay of the injunction on 22 June 2026 to EOFlow's conduct in South Korea, the EU, Qatar, Saudi Arabia and the United Arab Emirates.
Insulet says the reversal had no effect on its financial statements because it never booked the damages. The Supreme Court takes only a small share of the cases it is asked to hear, so for now the reversal stands and EOFlow is not bound by the judgment. We could not review the text of the October orders, so details such as the exact order dates and any votes are not confirmed.
Evidence that starts the day a file is shared. CADChain encrypts CAD files, controls who can open, edit or export each one, and logs every access with blockchain timestamps, so you know early when files go where they should not.
👉 See how CADChain works
What does this mean for engineering companies in Europe?
The case was decided under US federal law, but the EOPatch 2 was sold in the EU, and EU conduct was carved out of the injunction during the appeal. European companies that sue in the United States face the same three-year DTSA clock.
At home, the EU Trade Secrets Directive leaves limitation rules to the member states but caps the period at six years. In Germany, claims generally follow the regular three-year period, counted from the end of the year in which the owner learned, or should have learned, of the claim and the infringer. The details differ by country, but the pattern is the same as in the Insulet case: the clock is tied to what you knew or should have known, not to when you finally had the full proof.
What should engineering teams do now?
- Treat key departures as a trigger. When an engineer with deep design access joins a competitor, open a file: what they could reach, what they downloaded, what they still hold. Do it within weeks, not years.
- Write down what you know, and when. Emails that say "cloned" or "almost identical" were used against Insulet. Route those observations to legal, record the date and decide on a course of action.
- Watch competitors' public disclosures. Trade show samples, product launches, patent filings and IPO prospectuses count as information a diligent company should have read.
- Map each trade secret to its files. Know which CAD assemblies, design history files and algorithms are your crown jewels and who had access to each.
- Keep access logs you can rely on. A log showing who opened, exported or copied a CAD file, and when, is the direct evidence the court said is rarely available.
- Control files at the file level. Encryption and per-file permissions mean that a file copied by a departing engineer or consultant cannot simply be opened elsewhere.
- Diary the deadline. Once there is reason for concern, count three years under the DTSA and check the local rule in each EU country where you might sue.
- Decide early about suing or settling. A cease-and-desist letter or a lawsuit filed on access and similarity is better than a perfect case filed too late.
For background, see our ultimate guide to trade secrets for deep-tech startups, trade secrets versus patents for CAD designs, how to prevent CAD file exfiltration by former employees, medical device CAD protection and FDA compliance, why NDAs alone are not enough for CAD protection, audit trail requirements for IP litigation, how courts treat blockchain evidence in IP cases and the legal proof needed to show CAD file ownership. This month we also covered the 116.9 million dollar Joby v. Aerosonic trade secret verdict, the Apple v. OpenAI case about engineers who change jobs and the Samsung DRAM leak to CXMT and the sentence cut in Seoul.
How does this fit the bigger picture?
Our sister sites covered other developments this week that touch the same question: who controls engineering data, and how you prove it.
- Fast bulk downloads from collaboration tools. A data extortion group has listed several manufacturers on its leak site, using a method built on phone scams and SharePoint downloads. Read what the Helix SharePoint data theft campaign means for SOLIDWORKS teams on solidboris.com.
- CAD files sent to AI tools. A new AI agent drafts CNC quotes from forwarded RFQ emails and CAD files, under terms that give its maker a broad licence to the data. Our sister site explains what Inventor teams should check before sending CAD files to an AI quoting agent.
- Opt-outs for creative work. Australia is debating whether creators should be able to opt out of AI training, with no decision yet. Blended BORIS looks at the Australian AI copyright opt-out debate and what it means for artists.
Conclusion
Insulet persuaded a jury that its Omnipod CAD files and know-how ended up with a competitor, and still lost the verdict, because the facts it needed were in its own inbox years before it went to court. The appeals court did not demand certainty. It asked whether Insulet knew enough to make a claim, and found that a former engineer at a rival plus a lookalike product at a trade show were enough.
The answer for engineering companies is not to sue at the first rumour. It is to know which files matter, see when they move, and act on warning signs while the clock is still running. Companies that can show who had which CAD file and when are in a far stronger position, whatever happens next.
Know where your CAD files are, and prove it. CADChain gives engineering teams file-level encryption, per-file permissions, access logs and blockchain proof of ownership for CAD files, across CAD systems, partners and consultants.
👉 Protect your CAD files with CADChain
FAQ: Insulet v. EOFlow trade secrets case
What is the Insulet v. EOFlow case about?
Insulet, maker of the Omnipod insulin patch pump, sued South Korean rival EOFlow in 2023 for trade secret misappropriation over its EOPatch 2. A jury found that EOFlow misappropriated four trade secrets, including Omnipod CAD files, after hiring former Insulet employees.
Why was the 452 million dollar verdict overturned?
On 28 May 2026, the Federal Circuit held 2-1 that the claim was barred by the three-year statute of limitations in the Defend Trade Secrets Act. Insulet knew a former engineer worked for EOFlow by March 2019 and had seen a very similar product in 2018, but only sued in August 2023.
What happened in October 2026?
Law360 reported that the Federal Circuit denied Insulet's petition for rehearing on 19 October 2026 and, on 23 October, refused to keep the injunction against EOFlow in place while Insulet appeals to the US Supreme Court.
When does the DTSA statute of limitations start?
Three years after the misappropriation is discovered or, with reasonable diligence, should have been discovered. In this case the court said knowing about access through a former employee plus a similar product was enough, even without exact dimensions or proof.
Does one late claim affect other trade secrets?
Yes, if they are related. A continuing misappropriation is a single claim, so secrets disclosed by the same person, in the same period, for the same purpose share one accrual date, including secrets that cannot be seen in the product.
Does this apply to European companies?
It applies to any company bringing a DTSA claim in the US. In the EU, the Trade Secrets Directive leaves limitation periods to member states, capped at six years, and many national rules also run from when the owner knew or should have known.
What should engineering companies do after a key engineer leaves for a competitor?
Review what the person could access and download, secure devices, record what you know with dates and get legal advice early so the limitation period does not run out.
How can CADChain help?
CADChain encrypts CAD files, sets per-file permissions and logs every access with blockchain timestamps. That makes files harder to take and gives early, dated evidence of who had which file.
