.....6.9 million users.....about half of their 14 million users.....


.....hackers accessed about 5.5 million and because of the nature of some accounts that can share data with others, they accessed the additional accounts....


23andMe confirms hackers stole ancestry data on 6.9 million users

.....On Friday, genetic testing company 23andMe announced that hackers accessed the personal data of 0.1% of customers, or about 14,000 individuals. The company also said that by accessing those accounts, hackers were also able to access “a significant number of files containing profile information about other users’ ancestry.” But 23andMe would not say how many “other users” were impacted by the breach that the company initially disclosed in early October.

As it turns out, there were a lot of “other users” who were victims of this data breach: 6.9 million affected individuals in total.

In an email sent to TechCrunch late on Saturday, 23andMe spokesperson Katie Watson confirmed that hackers accessed the personal information of about 5.5 million people who opted-in to 23andMe’s DNA Relatives feature, which allows customers to automatically share some of their data with others. The stolen data included the person’s name, birth year, relationship labels, the percentage of DNA shared with relatives, ancestry reports and self-reported location.

23andMe also confirmed that another group of about 1.4 million people who opted-in to DNA Relatives also “had their Family Tree profile information accessed,” which includes display names, relationship labels, birth year, self-reported location and whether the user decided to share their information, the spokesperson said. (23andMe declared part of its email as “on background,” which requires that both parties agree to the terms in advance. TechCrunch is printing the reply as we were given no opportunity to reject the terms.)

It is also not known why 23andMe did not share these numbers in its disclosure on Friday.

Considering the new numbers, in reality, the data breach is known to affect roughly half of 23andMe’s total reported 14 million customers.

In early October, a hacker claimed to have stolen the DNA information of 23andMe users in a post on a well-known hacking forum. As proof of the breach, the hacker published the alleged data of one million users of Jewish Ashkenazi descent and 100,000 Chinese users, asking would-be buyers for $1 to $10 for the data per individual account. Two weeks later, the same hacker advertised the alleged records of another four million people on the same hacking forum.

TechCrunch found that another hacker on a separate hacking forum had already advertised a batch of allegedly stolen 23andMe customer data two months before the widely reported advertisement.

When we analyzed the months-old leaked data, TechCrunch found that some records matched genetic data published online by hobbyists and genealogists. The two sets of information were formatted differently, but contained some of the same unique user and generic data, suggesting the data leaked by the hacker was at least in part authentic 23andMe customer data.

In disclosing the incident in October, 23andMe said the data breach was caused by customers reusing passwords, which allowed hackers to brute-force the victims’ accounts by using publicly known passwords released in other companies’ data breaches.

Because of the way that the DNA Relatives feature matches users with their relatives, by hacking into one individual account, the hackers were able to see the personal data of both the account holder as well as their relatives, which magnified the total number of 23andMe victims......


........the extent........of the hack............?!

---

_____________________________________

I reject your reality and substitute my own!



Edited 2 time(s). Last edit at 12/05/2023 02:36PM by NewtonMP2100.

Your genetic information is a whole different level of "personal information". What was I thinking when I did 23andMe? Duh.

And...what can they do with this that would justify a ransom to get it back? Your mother's maiden name is already in a number of breaches.

Quote
Acer
And...what can they do with this that would justify a ransom to get it back? Your mother's maiden name is already in a number of breaches.

I actually bet they could find a way to use your family tree to their advantage, but if they have your genetic code, I can only imagine what they might be able to do with that. I don't think like a criminal, so I don't know what, but I have faith in them to figure something out. And it could be really bad.


What if they sold the info to someone in the insurance business on the down low? Could they find ways to exclude you from coverage if they knew you had a genetic disorder? Idk, I'm just imagining.



Edited 1 time(s). Last edit at 12/05/2023 05:38PM by kj.

I am a geneticist.

I have been given 23andme and ancenstry.com tests.

I read their licensing agreements.

I absolutely would NEVER give them my DNA.

And that's before consideration of data breaches like this.

A little dated, but some basic explanations of why it's a serious problem:

[www.theverge.com]
[www.vice.com]
[www.npr.org]
[www.consumerreports.org]

Edit: and like sekker, I'm a geneticist and I would *never* give my DNA to 23andme or a similar company.

---

Freya says, 'Hello from NOLA, baby!' (Laissez bon temps rouler!)



Edited 2 time(s). Last edit at 12/05/2023 06:26PM by PeterB.

Denied insurance or profiled by cops or denied a job based on leaked genetic info? If it was leaked, then the integrity of the information cannot be confirmed. Who knows how it was manipulated it after the leak. Useless.

I'm much more concerned about these DNA collectors selling the confirmed data outright. That's the real threat, not these hackers.

Quote
Acer
Denied insurance or profiled by cops or denied a job based on leaked genetic info? If it was leaked, then the integrity of the information cannot be confirmed. Who knows how it was manipulated it after the leak. Useless.

I'm much more concerned about these DNA collectors selling the confirmed data outright. That's the real threat, not these hackers.

As mentioned in the articles I posted, the insurance companies don't need to verify the data, nor do they need to reveal why they are approving or denying coverage. They can always give a reason other than the leaked data.

---

Freya says, 'Hello from NOLA, baby!' (Laissez bon temps rouler!)

Quote
PeterB
A little dated, but some basic explanations of why it's a serious problem:

[www.theverge.com]
[www.vice.com]
[www.npr.org]
[www.consumerreports.org]

Edit: and like sekker, I'm a geneticist and I would *never* give my DNA to 23andme or a similar company.

Keep in mind, when you give YOUR DNA away, you are also giving half the DNA of a sibling, parent, or child.

the insurance companies don't need to verify the data, nor do they need to reveal why they are approving or denying coverage.

That was my first thought when I saw that argument.

Quote
sekker

Quote
PeterB
A little dated, but some basic explanations of why it's a serious problem:

[www.theverge.com]
[www.vice.com]
[www.npr.org]
[www.consumerreports.org]

Edit: and like sekker, I'm a geneticist and I would *never* give my DNA to 23andme or a similar company.

Keep in mind, when you give YOUR DNA away, you are also giving half the DNA of a sibling, parent, or child.

Yes, again that's mentioned in the articles I posted ... that you're essentially giving the police a way to track all your relatives. It's not just your siblings, parents, children, it's potentially your second cousins, etc.

---

Freya says, 'Hello from NOLA, baby!' (Laissez bon temps rouler!)

People's genetic profiles floating around out there has consequences yet to be seen and felt, scary.

---

Ways to improve web conference image and sound quality. [forums.macresource.com]

Just wait until people start dropping dead from poisons, virii, and nerve agents to specifically targeted victims by their DNA.

When it happens, I'll tell you I called it.

Life imitates art imitating like imitating...

You heard it hear. (LOL)

---

I am that Masked Man.

All you can do, is all you can do.

There’s trouble — it's time to play the sound of my people.

Your boos mean nothing to me, I've seen what you cheer for.

Insisting on your rights without acknowledging your responsibilities isn’t freedom, it’s adolescence.

I've been to the edge of the map, and there be monsters.

We are a government of laws, not men.

Everybody counts or nobody counts.

When a good man is hurt,
all who would be called good
must suffer with him.

At the going down of the sun and in the morning
We will remember them.

You and I have memories longer than the road that stretches out ahead.

There is no safety for honest men except
by believing all possible evil of evil men.

We don’t do focus groups. They just ensure that you don’t offend anyone, and produce bland inoffensive products. —Sir Jonathan Ive

An armed society is a polite society.
And hope is a lousy defense.

You make me pull, I'll put you down.

I *love* SIGs. It's Glocks I hate.

Quote
RAMd®d
Just wait until people start dropping dead from poisons, virii, and nerve agents to specifically targeted victims by their DNA.

When it happens, I'll tell you I called it.

Life imitates art imitating like imitating...

You heard it hear. (LOL)

There is a Star Trek TNG episode about that.

---

Ways to improve web conference image and sound quality. [forums.macresource.com]