2y ago

User data stolen from genetic testing giant 23andMe is now for sale on the dark web

www.businessinsider.com

User data stolen from genetic testing giant 23andMe is now for sale on the dark web::User data from 23andMe accounts has been leaked and put up for sale on a dark web forum after what appeared to be a "credential stuffing" cyberattack.

32 comments

Note: this was from password stuffing and is only profile data, not genetic.
Your genomics can only be downloaded from a link sent to your email account.
Don't reuse your passwords.
The only thing 23andme could have done to prevent this is 2fa.
- The only thing 23andme could have done to prevent this is 2fa.
  Not true. It's easy to detect hundreds of thousands of logins from VPN locations. Or parse that someone is logging in from thousands of miles away from their profile location and send an email. There's many simple things to implement that they could have done to protect your account with them. They took the easy route.
  While the User does bare most of the blame, claiming that 23andme couldn't do anything else is strictly wrong.
  
  Preventing these kinds of attacks is a nontrivial problem space and is the exact reason why scraping services are a lucrative business.
  It is not trivial to prevent dark web actors from using botnets to make requests and it is comparatively inexpensive to access botnets as a service.
  Sending emails for suspicious login is 2fa, by the way.
- Or, and hear me out, don’t reuse passwords.
  
  That's what users could have done, not the site.
Well… that data was not in safe hands in the beginning considering facts that the whole company has very close ties to Alphabet and Google.
- You can say whatever you like about Google invading privacy and generally spying on us, but they are probably the best tech company when it comes to security. They practically never get hacked
  
  Them not getting easily hacked =/= your data is safe in their hands.
  
  Makes sense. They profit on our data, if they let it get stolen it will cut into their bottom line.
  
  Companies have to know about an attack and announce it to the public for it to exist? For all anyone knows Google is littered with backdoors and zero days and the people responsible are smart enough to siphon off the data quietly. Nothing is safe online and we need to stop pretending Google wouldn't downplay or sweep a breach under the rug to save face.
  Google shouldn't be trusted with the data we give them in the first place.
  
  Yeah... like it matters if your data gets thrown around anyway. They sell and share it with third parties without you knowing which and what security practices they use. I rather pay for a product that includes my privacy being protected.
- Your comment implies that they get hacked all the time - which they don't.
  But I see what you're saying, since they themselves sell your data.
  
  Yes, that is what I meant. Google/Alphabet are companies living off selling personal data. That is a big no no no no nooo.
probably cause they didn't invest much in cybersec..like most companies..and they deserve it, for not hiring such essential engineers
- They're not the ones with their genetic data for sale on the dark web though...
- Credential stuffing is, first and foremost, a user issue. There’s only so much you can do when people use the same password for all their different websites.
  That being said, there are some “above and beyond” steps a platform can take and most companies definitely don’t.
- Yeah, this is a decades old ongoing issue with companies. They see pretty much anything IT related as a money sink that needs to be trimmed to the bare bones while giving salespeople absurd bonuses. Then they get all surprised pikachu faced when they get hacked or hit with ransomware and their last backup was 6 months ago when they let the IT department go without warning and hired some guys from overseas to handle it remotely.
This is the best summary I could come up with:
Hackers claiming to have access to the names, photos, birth details, and ethnicities of potentially millions of 23andMe customers are peddling the information on the dark web for thousands of dollars.
"The preliminary results of this investigation suggest that the login credentials used in these access attempts may have been gathered by a threat actor from data leaked during incidents involving other online platforms where users have recycled login credentials," a spokesperson for the company told Insider.
In other words, the hackers plugged in leaked username-password combinations into 23andMe accounts in a technique known as "credential stuffing."
One anonymous seller advertised the data on BreachForums earlier this week as containing "DNA profiles of millions, ranging from the world's top business magnates to dynasties often whispered about in conspiracy theories," and noted that each set of data also came with "corresponding email addresses," based on a repost of the ad on X.
Based on the results of its preliminary investigation, the company believes the hackers gained access to a much smaller number of user accounts, but managed to scrape the data of several other 23andMe users through a feature called DNA Relatives.
There may also be "hundreds of thousands of users of Chinese descent" impacted by the leak," Wired reported.
The original article contains 570 words, the summary contains 209 words. Saved 63%. I'm a bot and I'm open source!
A 23andMe spokesperson said there's no indication there was data security in its systems.
You don't say..
WCGW giving your DNA to a company? Seriously, the data breach is an issue and this company has to be sued for this. But, giving your DNA to them is another one.
- Not only your DNA, but your whole family tree's DNA. It's just wrong on so many levels.

32 comments