iscover
Share this article on:
Powered by
MOMENTUM
MEDIA
Ancestry and genetics testing company 23andMe has confirmed that a tranche of its user data has been leaked, impacting at least 1 million people.
23andMe confirmed the leak on 6 October, and it appears the data has been posted online at least twice – once on 2 October and once on an earlier date, though that thread has since been deleted. It appears the original poster did not receive enough thanks for their apparent “work”.
“Users on this forum are only interested in credentials,” said a user called Golem in his original post. “Not even five people thanked me for the topic I opened. You deserve nothing.”
A second user, who did think the information worthwhile – which contains names and dates of birth, 23andMe profile IDs, regional genetic data, and three sets of possible population identifiers, including Ashkenazi – then reposted the data.
According to the 23andMe statement, the data was accessed using login credentials that had been compromised in previous hacks on other websites. The threat actor then scraped the data of those user’s genetic relatives. 23andMe users can opt-in to share their connections with other users if they choose.
“We believe that the threat actor may have then, in violation of our Terms of Service, accessed 23andMe.com accounts without authorisation and obtained information from certain accounts, including information about users’ DNA Relatives profiles, to the extent a user opted into that service,” 23andMe said.
The company then went on to confirm that – to the best of its knowledge – 23andMe’s internal systems have not been compromised, and to remind users to enable more secure login methods.
“When we receive information through those processes or from other sources claiming customer data has been accessed by unauthorised individuals, we immediately investigate to validate whether this information is accurate,” the company said. “Since 2019, we’ve offered and encouraged users to use multifactor authentication (MFA), which provides an extra layer of security and can prevent bad actors from accessing an account through recycled passwords.”
While the current post seems to offer the entire dataset – including one archived file containing just individuals with an Ashkenazi Jewish background – the original poster was selling the data in “tailored ethnic groupings”, according to a screenshot taken by Bleeping Computer.
“On offer are DNA profiles of millions, ranging from the world’s top business magnates to dynasties often whispered about in conspiracy theories,” Golem wrote in their original post.
“Each set of data also comes with corresponding email addresses.”
23andMe encourages its users to change their passwords, use strong passwords, and enable MFA.
David Hollingworth has been writing about technology for over 20 years, and has worked for a range of print and online titles in his career. He is enjoying getting to grips with cyber security, especially when it lets him talk about Lego.
Be the first to hear the latest developments in the cyber industry.
