2 ms·

> To clarify, there was no breach of 23andMe's system. Is this solid information? A lot of different stories in media. For instance, WP reported that there was

> To clarify, there was no breach of 23andMe's system. Is this solid information? A lot of different stories in media. For instance, WP reported that there was a breach. Some other stories report a 1M-7M breach. Another thing, of course, is that the company blatantly violates the GDPR and related laws: "But during the account deletion process, 23andMe tells users that the company and its partner lab will hang onto your “genetic information, date of birth and sex,” after your account is deleted, per state and federal legal requirements, according to two 23andM3 users, who shared screenshots of the deletion process with The Post." https://www.washingtonpost.com/technology/2023/10/12/23andme-hack-data-breach/ https://www.washingtonpost.com/technology/2023/10/12/23andme... https://therecord.media/scraping-incident-genetic-testing-site https://therecord.media/scraping-incident-genetic-testing-si...

hn_throwaway_99 3y ago
> Is this solid information? A lot of different stories in media. For instance, WP reported that there was a breach. I have not seen a single article reporting that there was an actual compromise of 23andMe's security systems. If you have any examples, please share. I have seen articles calling this a "data breach" (TFA calls it that), but it always leads to details saying it was just normal credential stuffing.
- jruohonen 3y ago
  Sure: we can debate what amounts as "a breach to a system". If personal data leaks through credential stuffing, scraping, or whatever, I still call it a breach personally.
  - junon 3y ago
    That's not a breach IMO. That's improper user security.
    - Moldoteck 3y ago
      yep, should have enabled 2fa by default
  - hn_throwaway_99 3y ago
    Then literally every consumer-facing tech company suffers "data breaches" continually, every day. The distinction isn't just important - without it, the word has no viable meaning.

hn_throwaway_99 3y ago

> Is this solid information? A lot of different stories in media. For instance, WP reported that there was a breach. I have not seen a single article reporting that there was an actual compromise of 23andMe's security systems. If you have any examples, please share. I have seen articles calling this a "data breach" (TFA calls it that), but it always leads to details saying it was just normal credential stuffing.

jruohonen 3y ago
Sure: we can debate what amounts as "a breach to a system". If personal data leaks through credential stuffing, scraping, or whatever, I still call it a breach personally.
- junon 3y ago
  That's not a breach IMO. That's improper user security.
  - Moldoteck 3y ago
    yep, should have enabled 2fa by default
- hn_throwaway_99 3y ago
  Then literally every consumer-facing tech company suffers "data breaches" continually, every day. The distinction isn't just important - without it, the word has no viable meaning.