Beaten and wounded 23andMe under investigation after breach that stole seven million users’ information
23andMe, the company based in California that markets DNA testing kits to assist individuals in discovering their heritage and potential health vulnerabilities, is currently under examination by British and Canadian data protection authorities following a security violation where hackers accessed the personal information of nearly seven million users.
As previously highlighted in recent findings reported, cybercriminals disclosed the data of millions of 23andMe users on a cybercrime forum in October 2023, revealing users’ full names, profile images, birthdates, gender, location, and genetic lineage details.
The hackers managed to breach user accounts through a credential-stuffing assault, exploiting those who mistakenly used the same password on 23andMe as on other platforms.
However, the breach worsened when hackers utilized a 23andMe feature called “DNA Relatives” to extract information about other users who did not make the password mistake.
The Information Commissioner’s Office (ICO) in the UK and the Office of the Privacy Commissioner of Canada (OPC) are presently conducting a collaborative inquiry into the security breach to establish its extent, assess the potential harm to individuals, and determine if 23andMe had sufficient measures in place to safeguard sensitive data.
An investigation will also be carried out to ascertain whether 23andMe appropriately notified regulatory bodies and impacted users about the significant breach. As discussed earlier, the repercussions of a DNA data leak could be substantial.
“In the event of misuse, an individual’s genetic details could be exploited for surveillance or discrimination,” noted Philippe Dufresne, Canada’s privacy commissioner.
23andMe has pledged full cooperation with the investigation but has consistently attributed responsibility to users who reused their login credentials.
Following the incident, all 23andMe users were advised to reset their passwords as a precaution, reminded not to reuse passwords, and prompted to activate two-factor authentication.
Since the data breach last October, 23andMe’s performance as a company has been dismal. With over 30 lawsuits pending, the company, once valued at $6 billion, now faces a plummet in share price and the risk of being delisted from the Nasdaq stock exchange. Some have suggested that 23andMe’s financially precarious position may lead to imminent bankruptcy.
This situation raises a crucial question. The most valuable asset of 23andMe is its DNA database. Who might acquire it, and what measures will they take to ensure the protection of this highly sensitive data from misuse or mishandling?
About Author
