Stories
Slash Boxes
Comments

SoylentNews is people

SoylentNews is powered by your submissions, so send in your scoop. Only 17 submissions in the queue.

23andMe: Profiles of 6.9 Million People Hacked

posted by martyb on Friday December 08 2023, @12:29AM   Printer-friendly
from the remember:-they-can't-use-what-they-don't-have dept.

fliptop writes:

Hackers have been able to gain access to personal information from about 6.9 million users of genetic testing company 23andMe, using customers' old passwords:

In some cases this included family trees, birth years and geographic locations, the company said.

After weeks of speculation the firm has put a number on the breach, with more than half of its customers affected.

The stolen data does not include DNA records.

[...] As was first reported by Tech Crunch, the company has acknowledged that by accessing those accounts, hackers were then able to find their way into "a significant number of files containing profile information about other users' ancestry".

The criminals downloaded not just the data from those accounts but the private information of all other users they had links to across the sprawling family trees on the website.

The stolen data includes information like names, how each person is linked and in some cases birth years, locations, pictures, addresses and the percentage of DNA shared with relatives.

I'm with Bill Burr on this.

See also: 23andMe Says Private User Data is Up for Sale After Being Scraped

Original Submission

 
This discussion was created by martyb (76) for logged-in users only, but now has been archived. No new comments can be posted.
23andMe: Profiles of 6.9 Million People Hacked | Log In/Create an Account | Top | 18 comments | Search Discussion
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
(1)

  • (Score: 5, Informative) by Tork on Friday December 08 2023, @12:39AM (4 children)

    by Tork (3914) Subscriber Badge on Friday December 08 2023, @12:39AM (#1335623) Journal
    There's an important aspect of this the BBC article isn't covering. Here's my source: https://gizmodo.com/what-23andme-data-breach-means-for-users-victims-1851080672 [gizmodo.com]

    In general, companies have a legal obligation to protect their customers from data breaches. The 23andMe hack could expose the company to lawsuits, but its legal team issued a quick update to prevent that.

    23andMe did not immediately respond to a request for comment.

    The company published a terms of service update last week (coincidentally, around the time it notified the Securities and Exchange Commission of its hacking debacle). The policy update forces users into a binding arbitration, which is a means to resolve disputes outside of court, as first reported by Stack Diary. 23andMe specifically prohibits a class action lawsuit against the company unless each person opts out of the arbitration. If you’re an affected person, you can opt-out by emailing arbitrationoptout@23andme.com within 30 days, meaning Dec. 30. This detail is tucked at the bottom of the fifth section for its updated terms of service.

    So... yeah, they want the profit but not the responsibility... and this is about a fair chunk of the information that we use to things like apply for credit cards.

    --
    🏳️‍🌈 Proud Ally 🏳️‍🌈 - Give us ribbiti or make us croak! 🐸

    • (Score: 2) by RS3 on Friday December 08 2023, @05:18PM (3 children)

      by RS3 (6367) on Friday December 08 2023, @05:18PM (#1335746)

      I'm not a lawyer, but my brother, who did this DNA thing a few years ago, is a lawyer. I need to get his thoughts on this.

      But it seems to me that a company's change to their policies should not affect an existing contractual relationship. I know pretty much all companies like to put in a clause saying "we reserve the right to change these terms at any time" but that crap should not hold up in court. If it does, our "system" is much worse than I already fear.

      • (Score: 2) by Reziac on Saturday December 09 2023, @02:52AM (2 children)

        by Reziac (2489) on Saturday December 09 2023, @02:52AM (#1335862) Homepage

        And my first thought was... the genetic data is processed in China. Explain to me where the expectation of privacy was in the first place??

        Unfortunately, yeah, most people would have no such thought, and would expect better. Terms of Service or no.

        --
        And there is no Alkibiades to come back and save us from ourselves.

        • (Score: 2) by RS3 on Saturday December 09 2023, @03:02AM (1 child)

          by RS3 (6367) on Saturday December 09 2023, @03:02AM (#1335864)

          genetic data is processed in China

          I didn't know that. That's horrific.

          Ever read a "terms of service" or "privacy agreement"? They always say they "value your privacy", which means your private data has value. But worse, they also always say "we may share your data with our "trusted partners". WTF!! Who are they? What are their privacy policies?

          I don't know what it's going to take, but I hope I live to see the day when governments start passing extremely strong privacy laws with large criminal penalties for lax safeguards. Hopefully it'll discourage most collection and storage of our info.

          Brother reported his 20andMe account wasn't one that was hacked, and from 23andMe:

          - *The threat actor was able to access less than 0.1%, or roughly 14,000
                user accounts, of the existing 14 million 23andMe customers through
                credential stuffing. *
                - *The threat actor used the compromised credential stuffed accounts to
                access the information included in a significant number of DNA Relatives
                profiles (approximately 5.5 million) and Family Tree feature profiles
                (approximately 1.4 million), each of which were connected to the
                compromised accounts.*

          So I asked him if his (and mine) might have been scooped up with someone else's that was hacked. Haven't heard back yet...

          • (Score: 3, Insightful) by Reziac on Saturday December 09 2023, @03:44AM

            by Reziac (2489) on Saturday December 09 2023, @03:44AM (#1335871) Homepage

            And I can't see governments doing any such thing. They're more than happy to have everyone else scooping data, so they can buy said data without violating any "No Snooping" laws. More likely we'll get laws stating that it's A-OK to do so.

            Word from disparate sources (so likely to be somewhat true) is that China is interested in pathogens that target by genome, hence....

            --
            And there is no Alkibiades to come back and save us from ourselves.

  • (Score: 4, Touché) by istartedi on Friday December 08 2023, @12:58AM

    by istartedi (123) on Friday December 08 2023, @12:58AM (#1335628) Journal

    Just oh-so shocked that people gave their data to a Si-Valley company where they "move fast and break things" and this happened. Sure they are always looking for ways to monetize data, break the law without actually facing the consequences, and turn a fast buck but they're such good people and I think they all use Apple computers so what could possibly go wrong? How could this happen?

    /sarcasm.

    --
    Appended to the end of comments you post. Max: 120 chars.

  • (Score: 4, Funny) by crafoo on Friday December 08 2023, @02:25AM (1 child)

    by crafoo (6639) on Friday December 08 2023, @02:25AM (#1335638)

    oh what a surprise. hacked you say? wow. how did that ever happen WOW I can't imagine wow just wow.

  • (Score: 5, Insightful) by Ox0000 on Friday December 08 2023, @03:03PM (4 children)

    by Ox0000 (5111) on Friday December 08 2023, @03:03PM (#1335727)

    If you have never used or even touched this service and yet have even only one relative that has used it, distant or not, then you too are affected. Because that's how genetics works.
    This is the problem with people not understanding the implications of handing data out willy-nilly in exchange for trinkets.

    Congratulations, your insurance claim was rejected, because a relative of yours has some markers for ${EXPENSIVE_DISEASE}, and we therefore assume you do too. Now get back in the streets and die there like the undesirable that you are!

    Some people take fiction ("1984", "Gattaca", ...) and assume it to be an instruction manual, rather than the warning they were intended to be. What is there not to understand about the word "dystopian"?

    • (Score: 3, Insightful) by RS3 on Friday December 08 2023, @05:14PM (3 children)

      by RS3 (6367) on Friday December 08 2023, @05:14PM (#1335744)

      Yeah, my full blood brother did it about 5 years ago, so I'm as good as scooped up in this mess. And yes, I'm very unhappy about this. Not sure what to do. Moving to another country and changing my full identity seems in order.

      • (Score: 3, Interesting) by Reziac on Saturday December 09 2023, @02:55AM (2 children)

        by Reziac (2489) on Saturday December 09 2023, @02:55AM (#1335863) Homepage

        My aunt did the basic test some years back. Learned absolutely nothing we didn't already know. "You are 100% Norwegian!"

        But yeah, the more-extensive tests and relationships are starting to become a problem. I vaguely recall a few crimes have been solved (was one a murder? I forget) thanks to this. No,. assume they don't always get it right... and consider how small the profile data really is... what is the incidence of false positives and negatives?

        --
        And there is no Alkibiades to come back and save us from ourselves.

        • (Score: 3, Funny) by RS3 on Saturday December 09 2023, @03:27AM (1 child)

          by RS3 (6367) on Saturday December 09 2023, @03:27AM (#1335867)

          "You are 100% Norwegian!"

          Ah, everything makes sense now. Norseman. Viking conqueror. Excellent swordmakers. Runes and stones and such. :)

          • (Score: 3, Funny) by Reziac on Saturday December 09 2023, @03:47AM

            by Reziac (2489) on Saturday December 09 2023, @03:47AM (#1335872) Homepage

            LOL. And the other side are basically Scots and Normans. So it's all one. :D

            --
            And there is no Alkibiades to come back and save us from ourselves.

  • (Score: 2) by Isia on Saturday December 09 2023, @05:57PM (4 children)

    by Isia (25931) on Saturday December 09 2023, @05:57PM (#1335934) Journal
    Ha ha. 🧠 🤏 I can only laugh at 23andMe customers for their stupidity.
    Once collected, DNA data must be protected for the rest of your life and that of your children.
    The genes of the dumbest of the dumb must be removed from the human gene pool.
    --
    Belief in a higher being is for the stupid, the weak and the cowardly.
(1)