{"id":23521,"date":"2023-12-04T14:10:11","date_gmt":"2023-12-04T22:10:11","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2023\/12\/04\/news-17251\/"},"modified":"2023-12-04T14:10:11","modified_gmt":"2023-12-04T22:10:11","slug":"news-17251","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2023\/12\/04\/news-17251\/","title":{"rendered":"23andMe says, er, actually some genetic and health data might have been accessed in recent breach"},"content":{"rendered":"\n

In October we reported<\/a> that the data of as many as seven million 23andMe customers were for sale on criminal forums following a password attack against the genomics company.<\/p>\n

Now, a filing with the US Securities and Exchange Commission (SEC)<\/a> has provided some more insight into the data theft. The filed amendment supplements the original Form 8-K submitted by 23andMe.<\/p>\n

The amendment says that an investigation showed that the attacker was able to directly access the accounts of roughly 0.1% of 23andMe’s users, which is about 14,000 of its 14 million customers. The attacker accessed the accounts using credential stuffing<\/a> which is where someone tries existing username and password combinations to see if they can log in to a service. These combinations are usually stolen from another breach and then put up for sale on the dark web. Because people often reuse passwords across accounts, cybercriminals buy those combinations and then use them to login on other services and platforms.<\/p>\n

With the breached accounts at their disposal, the attacker used 23andMe\u2019s opt-in DNA Relatives (DNAR) feature\u2014which matches users with their genetic relatives\u2014to access information about millions of other users. According to a spokesperson the DNAR profiles of roughly 5.5 million customers could be accessed in this way, plus the Family Tree profile information of 1.4 million additional DNA Relative participants.<\/p>\n

The 5.5 million DNAR Profiles contained sensitive details including self-reported information like display names and locations, as well as shared DNA percentages for DNA Relatives matches, family names, predicted relationships, and ancestry reports.<\/p>\n

For a subset of these accounts, the stolen data might contain health-related information based upon the user\u2019s genetics.<\/p>\n

The 1.4 million Family Tree profiles contain display names and relationship labels, plus other information that a user may have added, including birth year and location.<\/p>\n

23andMe is in the process of notifying users impacted by the incident. The company said it believes that the attacker activity is contained, and that it is working to have the publicly-posted information taken down.<\/p>\n

When the breach was first announced, 23andMe urged its users to ensure they have strong passwords, to avoid reusing passwords from other sites, and to enable multi-factor authentication (MFA)<\/a>.<\/p>\n

Our Mark Stockley noted at the time:<\/p>\n

\n

\u201cRespectfully, we would like to see 23andMe reach a different conclusion. Telling users to choose strong passwords and not to reuse them is great advice that just isn\u2019t working. It\u2019s good in theory but fails in practice. In a world where users have tens or even hundreds of logins to manage, password reuse and weak passwords that are easy to remember are inevitable.\u201d<\/p>\n<\/blockquote>\n

And it looks as if they listened to us. On the 23andMe blog the updated article about the breach<\/a> now says:<\/p>\n

\n

\u201cWe have taken steps to further protect customer data, including requiring all existing customers to reset their password and requiring two-step verification for all new and existing customers. The company will continue to invest in protecting our systems and data.\u201d<\/p>\n<\/blockquote>\n

Data breach<\/h2>\n

There are some actions you can take if you are, or suspect you may have been, the victim of a data breach.<\/p>\n