5 ms·

23andMe hackers accessed a whole lot of personal data

82 points by mikece 3y ago

shawnz 3y ago
I don't see any new information here.
iandanforth 3y ago
I recommend you only send your genetic data to companies if you're willing to have it exposed. Then again I also recommend you make your genetic data public, for the common good. Here's Mine: https://www.openhumans.org/member/iandanforth/ https://www.openhumans.org/member/iandanforth/
- Kiro 3y ago
  [flagged]
- ilrwbwrkhv 3y ago
  Can someone clone you with this? In the future?
  - iandanforth2 3y ago
    No, that would be quite impossible.
  - ourmandave 3y ago
    You know, I'd forgive all their trespasses if they used it to create a personalized organ transplant service.
  - trompetenaccoun 3y ago
    No, that's not possible. 23andMe doesn't do full sequencing, that would be too expensive for their average customer. The main reason people take the test, which they heavily advertise, is that it tells you your supposed ancestry. It's basically a modern, more sophisticated version of race science. Instead of only comparing skin color, skull shapes, noses and such, they now look at specific sequences in specific genes and compare them among many people from around the world. The claim is this can tell you what your "ethnicity" is and where your ancestors came from. Ignoring of course that humans (and the genes they carry) don't necessarily have fixed physical locations and the interpretation, while maybe true, may also be complete bunk. But Americans love it for maybe obvious reasons.
    - I_Am_Nous 3y ago
      I had a buddy take one of the tests and they basically just circled the UK and said "you're from here". He already knew that for the most part. The only benefit I can imagine* is knowing if I have individual genetic markers for something I should tell my son about.
- ghj 3y ago
  I remember deciding that I never want to ever have my DNA in any database after watching this talk: DEF CON 25 - John Sotos - Genetic Diseases to Guide Digital Hacks of the Human Genome (2017): https://www.youtube.com/watch?v=HKQDSgBHPfY https://www.youtube.com/watch?v=HKQDSgBHPfY
  - WhackyIdeas 3y ago
    Can you give your own quick summary?
    - toomuchtodo 3y ago
      Bioweapons targeting specific genetic characteristics. https://en.wikipedia.org/wiki/Gene_drive https://en.wikipedia.org/wiki/Gene_drive
      - zoogeny 3y ago
        When people talk about existential risk fears, this is without a doubt my fear. All it would take is a small group that is ethnically supremacist and technically capable. How many edge-lords joke that the problem with the world is that there are too many people? Imagine you could drastically reduce overall population while maintaining your own ethnicity. And it could be done slowly, a harsh flu now and again that affects the general population at a much higher percentage while sparing your own kin. It's terrifying to think this could be justified in the minds of some.
        blacksmith_tb 3y ago
        Though that's a chilling thought, I am more worried about someone trying to produce such a bioweapon, but just doing an amateur job and killing us all with their buggy alpha release.
        sgift 3y ago
        Imho, both scenarios are frightening, but for very different reasons.
- syndicatedjelly 3y ago
  Why should everyone make their genetic data publicly available? What common good does this serve?
  - AlotOfReading 3y ago
    If you're from an undersampled population (e.g. Africans), having more public data is useful for improving large scale genetic research. That's how we find things like ghost lineages. Most people's genetic data is significantly less valuable for research without other info (e.g. medical history) though, so I certainly wouldn't consider that universal advice considering the obvious privacy implications for you and your extended family.
- WhackyIdeas 3y ago
  Have you never seen an episode of Black Mirror?! But on a serious note, something seems so naive about making that available for anyone. The future is coming fast.
  - trompetenaccoun 3y ago
    Can't have your data leaked when you put everything online yourself. /s
    - major568 3y ago
      Not sure if it's a good idea ; reminds me of the classic "nothing to hide" motto https://en.wikipedia.org/wiki/Nothing_to_hide_argument#Criticism https://en.wikipedia.org/wiki/Nothing_to_hide_argument#Criti...
godelski 3y ago
I think the stuff you can do with DNA and genetic testing is wild in how cool and useful it can be. How it can save tons of lives and really accelerate our medical research. But at this time it also seems wildly irresponsible to share your genetic information considering the massive privacy implications and the impossibility of anonymization. Especially considering that PII spills over into your relatives, making the PII leakage often out of your control. I'm not sure how to resolve this tbh. Homomorphic encryption?
- dkarl 3y ago
  > Especially considering that PII spills over into your relatives, making the PII leakage often out of your control This is the part that gets me. I have young nieces and could conceivably have children someday. Making my DNA public could end up being an invasion of their privacy.
  - godelski 3y ago
    The Golden State killer was actually found due to their third cousin taking a DNA test. Obviously it is not perfect precision, but it reduced 850 suspects to 17[0]. These stories are great in that we found such a killer, but we cannot assume that data will always be used for good and I think history has shown us that it more frequently is used with malice. For context, third cousin is your great grand aunt/uncle's great grandchild[1]. E.g. your parent's parent's parent's sibling's child's child's, child. I am doubtful most people know their second cousin let alone their third (I'm sure there are those that do though). But this is showing the reach of that information leakage, because it can come from someone you have never met in your entire life and do not even have indirect communication with (given the likelihood of your great grandparent being dead and requiring your grandparent to be in contract with their cousins or your parent to be in contact with their second cousin). As more DNA is collected this extent might widen as statistical power increases but this is purely conjecture. I'll also note that the precision needed for reduction of suspects like this case is not the same as certain hereditary conditions but not for all. The main point is about how many people your actions affect and vise versa, that we do not live in a world where the consequences are exclusive to your actions (and importantly, where it is becoming less dominated by your actions). [0] https://www.science.org/content/article/we-will-find-you-dna-search-used-nab-golden-state-killer-can-home-about-60-white https://www.science.org/content/article/we-will-find-you-dna... [1] https://i.pinimg.com/736x/8a/cc/23/8acc23f05c79faabe0740d6566ccc2c1.jpg https://i.pinimg.com/736x/8a/cc/23/8acc23f05c79faabe0740d656...
sorokod 3y ago
Possibly the same breach discussed here [1]. [1]https://news.ycombinator.com/item?id=37931383 https://news.ycombinator.com/item?id=37931383
rafram 3y ago
Bad article. > The explanation is vague, so we don’t know exactly how many files were accessed They didn't access "files" on 23andMe's servers; they scraped information that 23andMe was making available through its UI to even the most distant of DNA "relatives." In a way I think that makes 23andMe even more culpable than it would have been if someone were able to break into their servers. > The company later confirmed the data’s authenticity, saying a hacker most likely used credential stuffing (trying an infinite amount of username/password combinations) to access its systems. That's not what credential stuffing is.
jonathankoren 3y ago
I’ve always found the breathless claims about genetic information being leaked, the shlockiest fear mongering of this data breach. Seriously. What’s the threat model here? A human clone? Someone hacking a police database to replacing some criminal’s dna record with your record? None of these are plausible. Even the reporting about compiling a list of people of Jewish ancestry is fear mongering. An antisemitic troll post? Absolutely. An actual novel threat? Well, probably not much more than a regexp and phonebook. Seriously. Give me a real scenario that has been demonstrated that uses this information in a way that someone with… oh $10 million in resources could do. I’ll wait.
- daveguy 3y ago
  Are you in biomedical research? I feel like the answer is no, because if you were you'd understand how fast paced discovery is in biotech these days. Just because it's not a threat today (I agree, it isn't), doesn't mean it's not a threat in a 10 or 20 year horizon.
  - user_7832 3y ago
    I agree. If you asked someone at Bell Labs whether the creation of a computer would cause gaming or digital addiction, the thought or idea wouldn't make sense because they didn't know what we know today.
  - keep_reading 3y ago
    That's great and all but again no genetic data was ever leaked at 23andme but everyone keeps reporting it like this is the information that was accessed by the attackers
    - daveguy 3y ago
      Agreed. But I was responding to johnathankoran about whether leaking / releasing your genetic information would even be a potential threat. I think it very well could be in 10-20 years (and possibly much less). Enough of a concern for me that I wouldn't trust a company with that information.
autotune 3y ago
Thanks dad.
1B05H1N 3y ago
Is credential stuffing even hacking? It's super lame that the company doesn't enforce 2FA.
senectus1 3y ago
this is why i've declined to get into the dna and ancestry tracking fad. you just cant trust them. unfortunately i think my mother has pulled my name into ancestry... not much i can do about that except not re-enforce the link

82 points by mikece 3y ago

I don't see any new information here.

I recommend you only send your genetic data to companies if you're willing to have it exposed. Then again I also recommend you make your genetic data public, for the common good. Here's Mine: https://www.openhumans.org/member/iandanforth/ https://www.openhumans.org/member/iandanforth/

Kiro 3y ago
[flagged]
ilrwbwrkhv 3y ago
Can someone clone you with this? In the future?
- iandanforth2 3y ago
  No, that would be quite impossible.
- ourmandave 3y ago
  You know, I'd forgive all their trespasses if they used it to create a personalized organ transplant service.
- trompetenaccoun 3y ago
  No, that's not possible. 23andMe doesn't do full sequencing, that would be too expensive for their average customer. The main reason people take the test, which they heavily advertise, is that it tells you your supposed ancestry. It's basically a modern, more sophisticated version of race science. Instead of only comparing skin color, skull shapes, noses and such, they now look at specific sequences in specific genes and compare them among many people from around the world. The claim is this can tell you what your "ethnicity" is and where your ancestors came from. Ignoring of course that humans (and the genes they carry) don't necessarily have fixed physical locations and the interpretation, while maybe true, may also be complete bunk. But Americans love it for maybe obvious reasons.
  - I_Am_Nous 3y ago
    I had a buddy take one of the tests and they basically just circled the UK and said "you're from here". He already knew that for the most part. The only benefit I can imagine* is knowing if I have individual genetic markers for something I should tell my son about.
ghj 3y ago
I remember deciding that I never want to ever have my DNA in any database after watching this talk: DEF CON 25 - John Sotos - Genetic Diseases to Guide Digital Hacks of the Human Genome (2017): https://www.youtube.com/watch?v=HKQDSgBHPfY https://www.youtube.com/watch?v=HKQDSgBHPfY
- WhackyIdeas 3y ago
  Can you give your own quick summary?
  - toomuchtodo 3y ago
    Bioweapons targeting specific genetic characteristics. https://en.wikipedia.org/wiki/Gene_drive https://en.wikipedia.org/wiki/Gene_drive
    - zoogeny 3y ago
      When people talk about existential risk fears, this is without a doubt my fear. All it would take is a small group that is ethnically supremacist and technically capable. How many edge-lords joke that the problem with the world is that there are too many people? Imagine you could drastically reduce overall population while maintaining your own ethnicity. And it could be done slowly, a harsh flu now and again that affects the general population at a much higher percentage while sparing your own kin. It's terrifying to think this could be justified in the minds of some.
      - blacksmith_tb 3y ago
        Though that's a chilling thought, I am more worried about someone trying to produce such a bioweapon, but just doing an amateur job and killing us all with their buggy alpha release.
        sgift 3y ago
        Imho, both scenarios are frightening, but for very different reasons.
syndicatedjelly 3y ago
Why should everyone make their genetic data publicly available? What common good does this serve?
- AlotOfReading 3y ago
  If you're from an undersampled population (e.g. Africans), having more public data is useful for improving large scale genetic research. That's how we find things like ghost lineages. Most people's genetic data is significantly less valuable for research without other info (e.g. medical history) though, so I certainly wouldn't consider that universal advice considering the obvious privacy implications for you and your extended family.
WhackyIdeas 3y ago
Have you never seen an episode of Black Mirror?! But on a serious note, something seems so naive about making that available for anyone. The future is coming fast.
- trompetenaccoun 3y ago
  Can't have your data leaked when you put everything online yourself. /s
  - major568 3y ago
    Not sure if it's a good idea ; reminds me of the classic "nothing to hide" motto https://en.wikipedia.org/wiki/Nothing_to_hide_argument#Criticism https://en.wikipedia.org/wiki/Nothing_to_hide_argument#Criti...

godelski 3y ago

I think the stuff you can do with DNA and genetic testing is wild in how cool and useful it can be. How it can save tons of lives and really accelerate our medical research. But at this time it also seems wildly irresponsible to share your genetic information considering the massive privacy implications and the impossibility of anonymization. Especially considering that PII spills over into your relatives, making the PII leakage often out of your control. I'm not sure how to resolve this tbh. Homomorphic encryption?

dkarl 3y ago
> Especially considering that PII spills over into your relatives, making the PII leakage often out of your control This is the part that gets me. I have young nieces and could conceivably have children someday. Making my DNA public could end up being an invasion of their privacy.
- godelski 3y ago
  The Golden State killer was actually found due to their third cousin taking a DNA test. Obviously it is not perfect precision, but it reduced 850 suspects to 17[0]. These stories are great in that we found such a killer, but we cannot assume that data will always be used for good and I think history has shown us that it more frequently is used with malice. For context, third cousin is your great grand aunt/uncle's great grandchild[1]. E.g. your parent's parent's parent's sibling's child's child's, child. I am doubtful most people know their second cousin let alone their third (I'm sure there are those that do though). But this is showing the reach of that information leakage, because it can come from someone you have never met in your entire life and do not even have indirect communication with (given the likelihood of your great grandparent being dead and requiring your grandparent to be in contract with their cousins or your parent to be in contact with their second cousin). As more DNA is collected this extent might widen as statistical power increases but this is purely conjecture. I'll also note that the precision needed for reduction of suspects like this case is not the same as certain hereditary conditions but not for all. The main point is about how many people your actions affect and vise versa, that we do not live in a world where the consequences are exclusive to your actions (and importantly, where it is becoming less dominated by your actions). [0] https://www.science.org/content/article/we-will-find-you-dna-search-used-nab-golden-state-killer-can-home-about-60-white https://www.science.org/content/article/we-will-find-you-dna... [1] https://i.pinimg.com/736x/8a/cc/23/8acc23f05c79faabe0740d6566ccc2c1.jpg https://i.pinimg.com/736x/8a/cc/23/8acc23f05c79faabe0740d656...

sorokod 3y ago

Possibly the same breach discussed here [1]. [1]https://news.ycombinator.com/item?id=37931383 https://news.ycombinator.com/item?id=37931383

rafram 3y ago

Bad article. > The explanation is vague, so we don’t know exactly how many files were accessed They didn't access "files" on 23andMe's servers; they scraped information that 23andMe was making available through its UI to even the most distant of DNA "relatives." In a way I think that makes 23andMe even more culpable than it would have been if someone were able to break into their servers. > The company later confirmed the data’s authenticity, saying a hacker most likely used credential stuffing (trying an infinite amount of username/password combinations) to access its systems. That's not what credential stuffing is.

jonathankoren 3y ago

I’ve always found the breathless claims about genetic information being leaked, the shlockiest fear mongering of this data breach. Seriously. What’s the threat model here? A human clone? Someone hacking a police database to replacing some criminal’s dna record with your record? None of these are plausible. Even the reporting about compiling a list of people of Jewish ancestry is fear mongering. An antisemitic troll post? Absolutely. An actual novel threat? Well, probably not much more than a regexp and phonebook. Seriously. Give me a real scenario that has been demonstrated that uses this information in a way that someone with… oh $10 million in resources could do. I’ll wait.

daveguy 3y ago
Are you in biomedical research? I feel like the answer is no, because if you were you'd understand how fast paced discovery is in biotech these days. Just because it's not a threat today (I agree, it isn't), doesn't mean it's not a threat in a 10 or 20 year horizon.
- user_7832 3y ago
  I agree. If you asked someone at Bell Labs whether the creation of a computer would cause gaming or digital addiction, the thought or idea wouldn't make sense because they didn't know what we know today.
- keep_reading 3y ago
  That's great and all but again no genetic data was ever leaked at 23andme but everyone keeps reporting it like this is the information that was accessed by the attackers
  - daveguy 3y ago
    Agreed. But I was responding to johnathankoran about whether leaking / releasing your genetic information would even be a potential threat. I think it very well could be in 10-20 years (and possibly much less). Enough of a concern for me that I wouldn't trust a company with that information.

autotune 3y ago

Thanks dad.

1B05H1N 3y ago

Is credential stuffing even hacking? It's super lame that the company doesn't enforce 2FA.

senectus1 3y ago

this is why i've declined to get into the dna and ancestry tracking fad. you just cant trust them. unfortunately i think my mother has pulled my name into ancestry... not much i can do about that except not re-enforce the link