3 ms·
To clarify, there was no breach of 23andMe's system. Instead, individual users had their accounts hacked (e.g. password reuse), and the "DNA relatives" feature
by hn_throwaway_99 3y ago
To clarify, there was no breach of 23andMe's system. Instead, individual users had their accounts hacked (e.g. password reuse), and the "DNA relatives" feature from 23andMe means you can see information about others who are a DNA match to you.
But you choose what you get to share in the first place. If you're willing to share that info to any rando who comes up as a DNA relative, is that data really considered that private to begin with?
- jruohonen 3y ago> To clarify, there was no breach of 23andMe's system. Is this solid information? A lot of different stories in media. For instance, WP reported that there was a breach. Some other stories report a 1M-7M breach. Another thing, of course, is that the company blatantly violates the GDPR and related laws: "But during the account deletion process, 23andMe tells users that the company and its partner lab will hang onto your “genetic information, date of birth and sex,” after your account is deleted, per state and federal legal requirements, according to two 23andM3 users, who shared screenshots of the deletion process with The Post." https://www.washingtonpost.com/technology/2023/10/12/23andme-hack-data-breach/ https://www.washingtonpost.com/technology/2023/10/12/23andme... https://therecord.media/scraping-incident-genetic-testing-site https://therecord.media/scraping-incident-genetic-testing-si...
- hn_throwaway_99 3y ago> Is this solid information? A lot of different stories in media. For instance, WP reported that there was a breach. I have not seen a single article reporting that there was an actual compromise of 23andMe's security systems. If you have any examples, please share. I have seen articles calling this a "data breach" (TFA calls it that), but it always leads to details saying it was just normal credential stuffing.
- jruohonen 3y agoSure: we can debate what amounts as "a breach to a system". If personal data leaks through credential stuffing, scraping, or whatever, I still call it a breach personally.
- junon 3y agoThat's not a breach IMO. That's improper user security.
- Moldoteck 3y agoyep, should have enabled 2fa by default
- hn_throwaway_99 3y agoThen literally every consumer-facing tech company suffers "data breaches" continually, every day. The distinction isn't just important - without it, the word has no viable meaning.
- Tempest1981 3y agoAssuming so, I'm surprised these high-profile folks are re-using passwords: > Some of the information has appeared for sale online, including that of prominent figures such as Mark Zuckerberg, Elon Musk and Sergey Brin, according to a press account cited in the lawsuit.
- GoblinSlayer 3y agoTo use a different authentication flow you need to change your habits and a bit of discipline, because it's extra friction.
- maximus-decimus 3y agoI imagine Mark and Elon aren't too scared about their life insurance rate increasing.
- Rebelgecko 3y agoOr one of their relatives is reusing passwords.