I predict a massive amount of identity fraud.. :-)

Lucas Nolan 4 Dec 2023156
3:18

Genetic testing giant 23andMe has admitted in a SEC filing that it has suffered a massive breach that has exposed the ancestry information of millions of customers utilizing the DNA Relatives feature.

Engadget reports that 23andMe, a popular genetic testing and analysis company, recently admitted it experienced a major data breach. According to an SEC filing, this breach affected a portion of the company’s user base, specifically targeting the opt-in DNA Relatives (DNAR) feature. This feature, designed to match users with genetic relatives, was exploited by hackers to access the accounts of about 14,000 of the 14 million total customers, representing roughly 0.1 percent of 23andMe’s user base.

Although the number of compromised accounts was small, the attackers managed to access the DNAR profiles of approximately 5.5 million customers. Additionally, they obtained Family Tree profile information from 1.4 million participants in the DNA Relatives program. These profiles contain sensitive details including display names, locations, shared DNA percentages, family names, predicted relationships, and ancestry reports. It’s also noted that Family Tree profiles include other voluntarily added information such as birth year and location.

The breach was done using a credential-stuffing attack, where hackers used login credentials from other compromised websites to gain unauthorized access to 23andMe accounts. The attackers were able to access and share a significant number of files containing profile information about other users’ ancestry online.

Upon discovering the breach, 23andMe promptly instructed affected users to change their passwords and implemented two-factor authentication for all customers. 23andMe stated that it “believes that the threat actor activity is contained,” and has since completed its investigation. The firm stated that it is notifying all impacted parties and is working to remove the publicly posted information.

Breitbart News first reported on the 23andMe hack in October, long before the company admitted the extent of the situation: