26 ms·
Hacker leaks millions more 23andMe user records on cybercrime forum
- globalise83 3y agoThis company definitely deserves a dooming Netflix documentary with lots of visuals of DNA and network-like structures.
- martin82 3y agoOnce precision medicine allows to create viruses tailored to kill or disable single individuals, the world is going to be a very very dark place. I don't think it's a surprise that COVID normalised it for people to hand over their genetic material to anyone (swabs) without any option for refusal (no test? no live).
- badcarbine 3y ago[dead]
- jjallen 3y agoI've been considering creating a distributed sort of human health monitoring/experiment project. One of the questions is "should I also add my DNA" in there. And if my DNA has been leaked then it wouldn't matter unless this leak is anonymous. With that in mind I wonder if you could use this data to sort of populate this project. I also wonder if that would be legal or not.
- smarri 3y agoI don't understand any comments which defend 23andMe. Personal data was leaked on their watch, it's unacceptable, end of story.
- bulbosaur123 3y agoCan those affected sue 23andMe?
- xyst 3y agoHope this company burns to the ground. Glad I never used this trash.
- Nellyz 3y ago[dead]
- Nellyz 3y ago[dead]
- Slava_Propanei 3y ago[dead]
- dizzydes 3y ago"23andMe blamed the incident on customers reusing passwords" I'm not sure how they worded this but it's their shortcoming, not their customers. Customers reuse passwords and will continue to do so. For sensitive PII it's far easier to enforce 2FA or Google SSO than to change customer behaviour.
- LegitShady 3y agoThey do have it but they probably have millions of accounts that were created before that feature and never logged back in and set it up. It's also through an auth app and not texts which is more secure but more of a hassle for not allowing users which might affect adoption.
- toomuchtodo 3y agoIt is very inexpensive to check your customer passwords against HIBP [1] or strongly encourage MFA. They choose not to. [1] https://haveibeenpwned.com/API/Key https://haveibeenpwned.com/API/Key (23andme customer using Apple SSO, have strong opinions on customer IAM, passwords must die)
- henryfjordan 3y agoDoesn't that require you to know the password in plaintext?
- toomuchtodo 3y agoDepending on your use case and implementation details, not necessarily. https://www.troyhunt.com/understanding-have-i-been-pwneds-use-of-sha-1-and-k-anonymity/ https://www.troyhunt.com/understanding-have-i-been-pwneds-us...
- hakcermani 3y ago.. can't those old accounts be flagged to require email verification to log in ?
- RockRobotRock 3y agoHas this landed on HIBP yet?
- crtasm 3y agoWe'll need a new site for it: Have I Been Cloned
- deleted 3y ago[deleted]
- RobotToaster 3y agoAs supportive of open source as I am, I had no desire to be open sourced.
- tap-snap-or-nap 3y agoYour clones are licensed as Creative Commons
- trallnag 3y agoMillions of users reuse passwords. This is nuts. Who are these people?
- bogota 3y agoMore importantly how was one person able to log in and download all that data without any alarms going off
- rsaxvc 3y agoThis. Every one of these attacks I've worked were loud due to the volume of logins and ratio of failures.
- sieste 3y agomaybe they all share the same password-reuse gene?
- challenger-derp 3y agothis made me spit out my morning coffee. ugh.
- wepple 3y agoMost of the world. People that don’t use HN or work in tech.
- Wissenschafter 3y agoI am a data engineer at a fortune 50 company, I do. It's infuriating that I'm expected to have a unique alphanumeric key to every single thing I use on a computer. That would be 100's of keys. It's nuts people think we should have unique passwords for everything.
- notpushkin 3y agoHave you already been introduced to such concept as password managers?
- bogota 3y agoIf they couldn’t detect millions of records stolen from credential stuffing I don’t think that makes them look any better. But Ill die before i see a company take ownership for their actions im sure so it’s no surprise
- schainks 3y agoWow, blaming paying customers for their inability to secure their systems. You cannot control users, but you can control your security posture. 23andme's management can fuck right off with their bad attitude and poor judgement.
- Phemist 3y agoThe attitude that oozes out of these reactions is not that they are sorry that the data was leaked, but that they are sorry they can no longer profit from it. 23AndMe's product is their user's DNA, packaged nicely in easy to digest formats.
- schainks 3y agoThey aren't sorry they can't profit from it, they will continue to profit from it anyway. One of their membership tiers includes an annual payment so you can get the newest easily digestible thing with your data. Shame on them for slacking off on security when bad actors could do actual dangerous things with that DNA data.
- blitzar 3y agoIt turns out those that like the idea of giving your DNA to VC's then you are also highly likely to reuse your one true password (password123) on multiple sites.
- hombre_fatal 3y agoIt's time to normalize services generating random passwords for users. Literally a password field with a "Reroll" button. Users shouldn't have to dick around with a more complicated 2FA system just to protect themselves from password reuse.
- happytoexplain 3y agoAs a security novice, I do wonder if this is more secure overall. It means users will increasingly either use password management tools or they will write it down, digitally and/or physically. So, it defeats password reuse, but the downsides are: 1. Makes it easier for users to lose passwords 2. Makes the user more susceptible to targeted hacking 3. Increases the number of passwords in note-taking services which may themselves be hacked Edit: Also, until a critical threshold is met of adoption among services, some users will just re-use the random password for other services. A lot of this is mitigated by making the password non-human-friendly, essentially forcing users to use password management tools. That could be too much to put on users, until those tools become much more ubiquitous/effortless for the average computer illiterate user (basically the same point you're making about 2FA).
- hombre_fatal 3y agoSure, but all of that is preferable to someone getting pwned across all of their accounts for one of their accounts getting leaked. Though I don't necessarily grant your points. Password reuse means you're susceptible to nontargeted attacks which is strictly worse than your concerns, like #2. i.e. Filtering out weaker attacks doesn't mean you're more susceptible to stronger attacks.
- happytoexplain 3y agoI do agree in that I think individual-targeting attacks are essentially outside the scope of this topic, since you're fucked for a lot more reasons in that scenario, and it's very rare, relatively speaking. I was just listing it to be thorough.
- 3y ago
- nsagent 3y agoExfiltrating 300TB of customer data without 23andMe noticing seems like negligence. Shouldn't there have been some alarms?
- TecoAndJix 3y agoif its not cred stuffing, a few GB per day per IP to defeat volume anomalies. you would hope 23andme would have detection/controls on customer storage to flag new geo locations since there is no way they spoofed each customer's destination. or an authorization flow to even access the data with an audit trail/approval flow for god accounts.
- jdjxhwvsh 3y ago“Hey Bob— why is our AWS bill so high this month… oh shit”
- rsaxvc 3y agoLol. "Hey Bob - why are we in the news for a breach?" Seems closer given the news reporting and their tardy response.
- SamuelAdams 3y agoYou joke but one of many organizations weakest points is lack of prompt alerting. I think the FBI recently put out a list of weakest points and this was maybe number 4 or 5 on the list. I’ll do some googling and see if I can find it. This is a forum of engineers and builders - if a lot of data were being exfiltrated from your cloud accounts right now, would you know? What would your response plan look like? Maybe this could be a good way for all orgs to review those practices and make sure they have a plan.
- dekhn 3y agowe've caught a few "oops I almost spent a million dollars" through cost alerting on AWS. Unfortunately, the time resolution for billing isn't great. I will say, much to my surprise, AWS comped us for the money we wasted even when it was our own fault.
- bagels 3y agoHow easy/legal is it to obtain breached passwords for legitimate purposes? If I see a user try to sign up with an email + password in the breach list, I'd like to tell them to pick a different password, for instance.
- cjoelrun 3y agoProbably also because sign up for the product is done through their app rather then a browser where people have password managers handy.
- murphyslab 3y ago> 23andMe blamed the incident on its customers for reusing passwords, and an opt-in feature called DNA Relatives, which allows users to see the data of other opted-in users whose genetic data matches theirs. If a user had this feature turned on, in theory it would allow hackers to scrape data on more than one user by breaking into a single user’s account. 23andMe's blame is an obfuscation of the problems which underlie this situation. 1. There is the matter of having insufficient granularity in their sharing options within the DNA Relatives program. It comes with two general levels, which is not enough. 2. 23andMe limits one to seeing the closest 1500 matches who have opted-in to DNA Relatives. That would have allowed a hacker to collect data on most people in the database despite having only a few thousand compromised accounts. (Haplogroups, ethnic origins predictions, names, profile data, a list of relatives, and information on geographic origins.) 3. The 1500 match limit would be helpful, in theory, however for some time (recently) it was possible to see profiles beyond those 1500 matches. I'm not certain if these were limited to only those who shared matching DNA segments but who fell outside of the 1500 match limit. And I can't be certain if this was part of the method exploited by these malicious actors.
- alwaysrunning 3y agoWow. What a shit company. It isn't the user's responsibility to secure the data that you store, it is 100% on you. If the user is reusing a pwd that might be the reason a single account got hacked but to beat a dead horse, you can mitigate that easily as a company. Karma seems to always work things out.
- BrandoElFollito 3y agoHow would you mitigate a password reuse?
- nextos 3y agoI also regret giving them my data. At work, we bought one of their first kits. We were doing genetics research and my boss got some for Christmas and gifted them to everyone in the group. Technically, 23andme is also pretty bad, which is hard to understand given that they employ very competent people and they are well funded. Seems like a space ripe for disruption. Their biggest competitor, DecodeME, never really aimed at B2C and just used customers to harvest data, then sold to a pharma. 23andme genetic risk scores are mediocre at best. Promethease makes better predictions. For example, in my case I have a high risk MHC allele, which is both trivial to predict and well understood since the 1980s. Never popped up on their reports, yet it is the first item you see if you feed your 23andme raw data to Promethease, or if you analyze the data yourself.
- hnburnsy 3y ago>The type of information genetic-testing companies collect is currently not protected by the Health Insurance Portability and Accountability Act (HIPAA), our nation’s health privacy law. Nice work by the genetic testing industry lobbyists.
- fkyoureadthedoc 3y agoDo you have a reference for this? Was it ever actually considered? Or are you just making things up?
- hnburnsy 3y agohttps://www.latimes.com/business/lazarus/la-fi-lazarus-dna-genetic-privacy-20190702-story.html https://www.latimes.com/business/lazarus/la-fi-lazarus-dna-g... >“We plan to engage constructively with policymakers on the best enforcement regime,” Haro said, reiterating that the coalition wants “a uniform national data privacy law” that treats all companies the same.
- hnburnsy 3y agoFrom the same article, 23&me is lucky they are not covered under HIPPA... >The federal Health Insurance Portability and Accountability Act, a.k.a. HIPAA, includes penalties ranging from $100 to $50,000 per violation — that is, per hacked record. Violations also can carry criminal charges resulting in jail time.
- fkyoureadthedoc 3y agoHIPAA applies to health care providers and health insurance companies. If you give some other type of entity your PHI they are not beholden to HIPAA. You said that this wasn't part of HIPAA specifically because of lobbying. You haven't provided anything that says that anyone was even considering expanding HIPAA to cover other entities. 23&Me wasn't even around to lobby when HIPAA was penned.
- ccooffee 3y agoThe laws and regulations around genetic information seem to be (intentionally?) easy to misread. Health and Human Services has a FAQ page[1] which states: > genetic information is health information protected by the Privacy Rule. Like other health information, to be protected it must meet the definition of protected health information: it must be individually identifiable and maintained by a covered health care provider, health plan, or health care clearinghouse. However, according to many other sources[2][3], the interpretation of these rules DOES NOT apply to companies like 23&Me. I assume the company is not considered "a covered health care provider, health plan, or health care clearinghouse", but (again) the HHS definitions are (intentionally?) vague/misleading[4]. I suppose you need to be very familiar with regulatory law to actually make sense of this junk. (I don't know the history of these regulations and carve-outs, but the tin-foil-hat part of me wants to blame lobbyists/legal-corruption for the lack of common-sense and simply worded regulations.) [1] https://www.hhs.gov/hipaa/for-professionals/faq/354/does-hipaa-protect-genetic-information/index.html https://www.hhs.gov/hipaa/for-professionals/faq/354/does-hip... [2] https://www.ncbi.nlm.nih.gov/pmc/articles/PMC6813935/ https://www.ncbi.nlm.nih.gov/pmc/articles/PMC6813935/ [3] https://lawforbusiness.usc.edu/direct-to-consumer-generic-testing-companies-is-genetic-data-adequately-protected-in-the-absence-of-hippa/ https://lawforbusiness.usc.edu/direct-to-consumer-generic-te... [4] https://www.hhs.gov/hipaa/for-professionals/covered-entities/index.html https://www.hhs.gov/hipaa/for-professionals/covered-entities...
- nerdjon 3y ago23andMe is one of my biggest regrets in my life, I did it before I really started caring about privacy. It was on sale on Amazon and yeah. It sucks since I have zero trust that they would actually delete my data if I asked them too, and even if they do is that data still living somewhere fed into some model or research or whatever. I hate to say that there is a part of me that kinda doesn't want to know if my data is a part of this, this just feels different than a credit card or some shopping data leaking. Even worse since I have not gone to 23andme in a while, I feel like this was likely also before I cared about proper password security so it would not surprise me.
- wnevets 3y ago> 23andMe is one of my biggest regrets in my life, I did it before I really started caring about privacy. It was on sale on Amazon and yeah. I've had someone give one as a gift, so glad I didn't do it.
- atarian 3y agoMeh, it's just some stuff they extracted from your spit. I wouldn't get bent out of shape over it. Who knows, we might all get a decent payout from a settlement. You certainly won't regret when that happens.
- bdamm 3y agoIt doesn't really matter. The genetic matching models are so primitive that there's really not much of value in the data anyway. Facebook and Google have a far more accurate picture of what can be used to manipulate you. 23andme is little more than a curiosity. My data is probably in this breach too, and I am not going to waste one second of my life on regret over it. Stay tuned to find out if you get something from the class action lawsuit. Like the experion hack, you may at least get an interesting coffee table artifact when they mail you a pathetically small check.
- sgarman 3y agoWhat about this? https://www.cbc.ca/news/world/dna-from-genealogy-site-used-to-catch-suspected-golden-state-killer-1.4637726 https://www.cbc.ca/news/world/dna-from-genealogy-site-used-t... Seems like there is at least some value.
- littlestymaar 3y agoDon't forget to change your DNA.
- jjtheblunt 3y agopretty much everyone has already done so? https://en.wikipedia.org/wiki/Retrovirus https://en.wikipedia.org/wiki/Retrovirus
- gumballindie 3y agoHow is this company still in business following this? Personal “genomics” should be treated like the most sensitive type of data out there. Failing to secure it means you are not suitable to carry such tests. I have already been advising people to be cautious about such online services, or to use fake personal details where possible. I will now advise even harder.
- landemva 3y agoThey are in business because people voluntarily pay them. This is what people want, so the market provides it. Many people do not care about preventive privacy.
- codedokode 3y agoWouldn't it be better (for users, not for profitability) if such companies would delete the data after analysis? DNA analysis is very important, and probably, should be mandatory for everyone planning to have children (to reduce the number of people with incurable or very expensive to treat diseases and save healthcare budget), but with current level of privacy protection the data will just leak around. Also, when DNA screening will become mandatory, government will probably require that it gets a copy of everybody's DNA. Looks like this war is already lost.
- ezfe 3y agoThe raw data wasn't leaked, and the data changes over time when other users join. Many people expect this. 23&Me allows you to delete your data and your account if you no longer want to participate.
- deleted 3y ago[deleted]
- keep_reading 3y agoDo we need to submit a new story to HN covering that the raw genetic data wasn't leaked? Everyone is screaming that sky is falling and ignoring the facts
- pstorm 3y agoEh, for some people the sky is falling. For instance, the original hacker was specifically offering profiles of Ashkenazi Jew, which included full name and location information. I understand how that could be scary in the hands of the wrong people.
- ezfe 3y agoYea, that's true - but has little to do with the fact it's a genetic data site. A family tree site with private profiles would have the exact same risk. The fact that the genetic data isn't involved means this story isn't relevant to people panicking about sharing their genetic data with 23&me.
- Phemist 3y agoThis DNA relatives feature begs the question. How easy is it to submit random DNA (cow, cat, dog, chicken, etc. or even fake?) and get yourself enrolled in their system to then legitimately have access to the next 1500+ "relatives?". Given a few grand to spend on testing kits I reckon you could get the same results stuffing this DNA, as this "golem" guy did by credential stuffing. 23AndMe made the classic mistake to assume that biometrics are a type of authentication and allowed anyone to access the records of 1500 other people just by submitting some DNA....
- samtho 3y ago> How easy is it to submit random DNA (cow, cat, dog, chicken, etc. or even fake?) and get yourself enrolled in their system to then legitimately have access to the next 1500+ "relatives?". You really must not fundamentally understand how this works. You are matched to people who also took a 23&me test and share DNA with you. The amount shared is how they infer relations. There are people who do not even have 1500 matches, submitting a sample of animal DNA will quickly result in sequencing failure as the test is based upon the human genome and is effectively “written in the hardware”. Fabricating a DNA is extraordinarily difficult because you need hundreds of cells with genetic material in order to even produce results. It would be so much easier to steal a sample from a known relative than it would be to genetically engineer some cells.
- itsafarqueue 3y agoI’m one of the leaked. I’m highly technical, security literate. I use unique secure passwords for everything. Fuck these guys. Fuck their bullshit misdirection. This is the equivalent of corporate doxxing. Until individual execs in these mega-corps that piss in the face of their users bear individual consequence for this type of thing it’ll keep happening. Because until then there’s no requirement to actually really give a shit. We’re grist in the money mill. The lack of consequence has me seething more than the breach. > Edit: the victim shaming in comments here is staggering.
- getu4543hji 3y agoI did 23andme and although I'm not happy about this, I admit I'm growing numb to all the leaks of information, and I kind of went into it with the assumption that it might be leaked at some point. https://www.nih.gov/news-events/news-releases/nih-s-all-us-research-program-returns-genetic-health-related-results-participants https://www.nih.gov/news-events/news-releases/nih-s-all-us-r... https://www.nytimes.com/2013/06/18/science/poking-holes-in-the-privacy-of-dna.html https://www.nytimes.com/2013/06/18/science/poking-holes-in-t... As you can surmise from those, the issues about DNA sharing are more general than 23andme, or even private companies. I mean, therapy notes have been leaked, and hospitals have had medical records compromised. I do genetics research and although 23andme does have sensitive information, the level of information they have is relatively low. People with certain polymorphisms might be at risk but most of it is pretty crude, and I suspect many of the people affected might know through nongenetic ways that they were at risk anyway. I think the genetics revolution people were predicting doesn't exist, or to the extent it does, it will require something different than what 23andme has. Google or Apple has more damning and accurate information about someone than 23andme. If 23andme or anyone else had some mind-blowing insights into you personally based on your genes, they'd certainly sell that to people and they don't. Most of their selling points are in genealogy and things like that. I don't mean to sound dismissive, this sucks and 23andme could/should have done things differently. It's just I think as a society we need something other than "live as a technohermit" or "implement such strict security you're at risk of shutting yourself out" and "become a permanent victim of darknet hackers and authoritarian tyrants". I also think people overestimate the information value of the genetic information 23andme has. Yes, it's significant, but it's really at this point limited to what they offer. There's no would-be 8yo serial killers out there that, if we only had 23andme information, would be able to "prevent" them from killing in some real-life version of Minority Report crossed with Gattaca. Maybe someday, with different information, but not now.
- dang 3y agoRecent and related: 23andMe Sued over Hack of Genetic Data Affecting Thousands - https://news.ycombinator.com/item?id=37895586 https://news.ycombinator.com/item?id=37895586 - Oct 2023 (20 comments) Who hacked 23andMe for our DNA – and why? - https://news.ycombinator.com/item?id=37886543 https://news.ycombinator.com/item?id=37886543 - Oct 2023 (3 comments) 23andMe Accounts Hijacked and Data Put Up for Sale on Hacker Forum - https://news.ycombinator.com/item?id=37810755 https://news.ycombinator.com/item?id=37810755 - Oct 2023 (2 comments)
- andersrs 3y agoThank you auntie Janice for leaking my genomic data. I'm sure the health insurance companies will love you.
- kube-system 3y agoIf you live in the US, the Genetic Information Nondiscrimination Act prohibits health insurers from using the data.
- mportela 3y agoI have trust in their ability to find loopholes in the act.
- LAC-Tech 3y agoAlways been a bit curious about 23 and me. But also I'm northwest european so paying money and giving out my data just to find out "100% British isles" or similar did not sound that interesting. Glad I obstained!
- globalise83 3y agoI guess the fun part was finding out your real great-grandfather was a Portuguese sailor on a visit to the port of Bristol (or whatever).
- LightBug1 3y ago[flagged]
- workfromspace 3y agohttps://archive.ph/vDb9J https://archive.ph/vDb9J
- deleted 3y ago[deleted]
- LelouBil 3y agoI am not sure if companies like this should be illegal or heavily regulated. Where I live (in France) recreational DNA testing is illegal since 1994. But also, if they were legal, with the GDPR they would have to obey much stricter rules about the data they collect.
- jacquesm 3y agoDon't say you weren't warned: https://jacquesmattheij.com/your-genetic-information-is-not-just-yours-but-it-is-family-property/ https://jacquesmattheij.com/your-genetic-information-is-not-...
- rdtsc 3y agoI was mildly curious and thought maybe I should try it, but the more I thought if I really trust this company. I've seen how companies treat their customers' data and imagined that being my genetic data, and it just didn't seem like a good idea. Then there is the point of what if I found I have some genetic disease and there is not much I can do about it. Not sure living with that knowledge would be better.
- jacquesm 3y agoIt's upsides if something treatable is discovered early, otherwise it is mostly downsides and not just for yourself. Assuming you can trust their analysis in the first place. What I really don't like about these companies is that they are never transparent, you only find out after the fact what you bought into.
- SpaceManNabs 3y agohow to find out if you are affected? 23andme is one of my biggest regrets. I did it when i was 22 and kind of an idiot lol.
- Flatcircle 3y agoI suspect that in the future, regulation of online things will lower the profits available to websites like this. They should have to pay a shit load of insurance if dealing in this type of business with lots of personal data. And the mistakes for making this type of mistake should be monumental.
- alephnerd 3y ago> pay a shit load of insurance if dealing in this type of business with lots of personal data Chubb's and AXA have been offering this for a couple years now and I know some large companies have taken out a policy. The issue I've heard is the large providers rarely pays out as the pools are small and the risk profile for breach insurance is still actively being worked on so the exposure is potentially massive, so a lot of companies are forgoing Cyber Liability insurance. There needs to be active regulatory work to solve this chicken-and-egg situation
- Mistletoe 3y ago“Pandora opened a jar left in her care containing sickness, death and many other unspecified evils which were then released into the world. Though she hastened to close the container, only one thing was left behind – usually translated as Hope.”
- DevX101 3y agoI used a fake name and one-off email address when submitting my results in anticipation of exactly this scenario.
- timvisee 3y agoThat would make it a bit harder to link to you, but definitely not impossible. It would definitely have been better to not do it at all.
- beaugunderson 3y agoOf the three leak files released so far there are 5,150,779 unique entries (I wanted to check if I was in them, so far I'm not).
- goryramsy 3y agoWhere are you checking?
- beaugunderson 3y agoThe leaked files; don't want to link here directly but I think they're all still available at the source
- CatWChainsaw 3y agoSometimes I think for a microsecond that doing a DNA test would be interesting and then I remember that breaches are inevitable and never do any.
- Moldoteck 3y agoWow, such a bad security combo: 1- Not enforcing 2fa for new accounts and migrating old ones to app 2fa on login + requiring mail code enter before that to create a temporary weaker 2fa, this way some users will spot the problem and click that they're hacked 2- lack of data encryption for servind data to client(so that 23me has full access to unencrypted db on isolated servers, but users will need to enter some additional password 3- not checking against existing pwned dbases and autoreset the password 4- better control for sharing dna data for ppl discovery. Why on earth they provide 1.5k matches, they could limit to 100 closest ones for example and provide 1.5k for additional pay For such a company that handles this data, I would have expected much harder security measures
- wly_cdgr 3y agoIt would be hard to do something worse with this data than what 23andMe would be happy to do themselves for profit
- throwingrocks 3y agoAre there any privacy safe companies out there that provides similar services? I’m interested in the ancestry and health aspects of 23andMe, but I obviously don’t trust the company.
- 3seashells 3y agoAbsolutely uninsureable for all genetic curses for generations to come..
- artursapek 3y agoI refused to try this service for years despite having friends suggest it to me over and over. At best they were going to sell your data to insurance companies and governments. At worst, criminals would end up with it. Why anyone would trust a private "viral" company like this with their DNA is beyond me. Best of all, you paid to give it to them.
- robotburrito 3y agoI found I have about 10+ brothers and sisters through 23andme. I knew the risk when I signed up and assumed something like this would have happened sadly.
- dekhn 3y agoHey, I found this out too. But I never did 23andme- my dad did, and he was the sperm donor.
- samtho 3y agoI, too, found this out about myself, but on AncestryDNA originally. I did find a previously unknown cousin my the other side of family thanks to 23&me. It’s a shame because the relative matching is a really fantastic tool and has been able to connect a lot of people who would otherwise not have met.
- EduardoBautista 3y agoWhat exact data was leaked? I have an account there but chose not to find potential relatives, which means, according to the article, I wouldn’t be part of the scraping.
- simplyinfinity 3y agoImagine I was one of those people that their DNA got leaked. How would that could/would/will affect me? And please, don't say "insurance companies would love that data!".
- deleted 3y ago[deleted]
- juped 3y agoYou'll get to experience the bottom percentile of Hacker News posting endlessly about how getting a cheap genetic test in the mid-2010s was obviously something only a total moron would do, and occasionally slipping in an "insurance companies would love that data!" (I'm not saying it, use-mention distinction) alongside it. Your raw data hasn't leaked unless it was your account in particular that got used, but you could be put on some guy's "Jew list", which you may or may not care about.
- taeric 3y agoThis is a social network that was leaked. I would be somewhat surprised if the same attack didn't also get quite a few of someone's "friend network" on Facebook and the like. Certainly was more likely in the past, but with some of the modern botnets, I have little faith some of my elderly family haven't been hacked in this way. To that end, I'm curious on how they could have protected this better? Almost certainly doable, but I don't know of many ways you can protect people that are on my contact list from getting leaked if my contact list is leaked. Which is essentially what this is.
- yawnxyz 3y agoif 23andMe knows this is happening, they should probably reset everyone's passwords...
- pokstad 3y agoThat’s what you get for sharing the most precious IP you own to a company that incriminates the relatives of customers.
- sw104 3y agoThe most precious IP you own, which you drop in the form of 50-100 fallen hairs every day, and is smeared on everything you touch. People submit more weaponizable (behavioural) data to Facebook, Google and HN every day.
- RheingoldRiver 3y ago23andMe came out when I was in high school, and one of my science teachers spent an entire class period telling us how bad an idea it would be to ever use their service. Probably the most valuable lecture I ever had tbh, I've never even considered going near it as a result. Makes me think that "data privacy" should be added into schools' mandatory health class requirements or something. Though most likely any prescribed curriculum would have been lobbied to death & not actually teach valuable information.
- therealdrag0 3y agoWhy is the lecture so valuable? Why was another commenters biggest regret using 23andme? (Talk about first world problems). What is private about dna?
- samtho 3y agoNothing, you abandon many viable samples of it wherever you go. This relates to the biggest problem with biometrics: it represents an effectively static attribute about an individual. It cannot be reset and therefore we place this enormous responsibility on the reading mechanism and pipeline to the authentication process to attest that the human using it is doing so with consent.
- renewiltord 3y agoMy genome is in All of Us. I don’t think this is such a big deal to have your genome out in the public.
- superduty 3y agoThat company absolutely needs to fire their ciso, and likely their full c suite.
- archiemckenzie 3y agoI’d be interested to know to what extent password reuse is genetically determined…