16 ms·
23andMe confirms hackers stole ancestry data on 6.9M users
- lunarimiso 3y agoDoes genetic data count as personal information? Just wondering as a EU citizen.
- docmars 3y agoCan someone remind me why we trust tech startups with our personal data, again?
- lesostep 3y ago"What do you have to fear if you have nothing to hide?" I fear stupid people in places of power. DNA-matching as a crime solving technique always was problematic. >> DNA Evidence is Not as Reliable as Many Believe it to Be https://www.lexology.com/library/detail.aspx?g=2800ffc0-c286-4094-80a5-ad4419908bc0 https://www.lexology.com/library/detail.aspx?g=2800ffc0-c286... >>The False Promise of DNA Testing https://www.theatlantic.com/magazine/archive/2016/06/a-reasonable-doubt/480747/ https://www.theatlantic.com/magazine/archive/2016/06/a-reaso... >>How Forensic DNA Evidence Can Lead to Wrongful Convictions https://daily.jstor.org/forensic-dna-evidence-can-lead-wrongful-convictions/ https://daily.jstor.org/forensic-dna-evidence-can-lead-wrong...
- ouraf 3y agoI know this is a terrible event and we should look at this critically, but i can't help but read this headline as the start of a sci-fi conspiracy theory/spy fiction novel. "It all started when that hacker group obtained the genomic data of millions of humans..."
- mrep8 3y ago"hackers stole" == "company sold"
- all_the_silly 3y ago[flagged]
- namaria 3y agoDo you have any material evidence or you just throw your prejudices at the wall and see what sticks?
- all_the_silly 3y ago[flagged]
- junon 3y ago[citation needed]
- skummetmaelk 3y agoThis disaster is the perfect counter-argument to those always saying "why do you care so much about privacy. It doesn't affect you when I share things. You can just choose not to do it", except no, I can't choose when we're relatives and you chose to share our genome. It is so obvious that your relatives sharing their genomic data with 23andMe reveals a lot of information about you. We can only hope people will realize that this also holds true for collecting behavioural data on other people sharing the same background as you.
- fsckboy 3y agoI'm in favor of privacy, and I'm willing to go more out of my way to not share than the vast majority of people, but I'm also in favor of individual choice, and I can't think of a privacy model that would disallow other people from sharing their information just because you have some matching information.
- suslik 3y agoThat can be achieved through anonimity. I don't understand why companies have to know who I am in such detail. Every little website requires my phone number, SSN, retina patterns and the name of my childhood pet. If I could use 23andme under the pen name "Ivar the Boneless" and pay for it with a bit of cash in an envelope (or crypto), the current problem wouldn't exist. Tools like Telegram or Signal do not allow creating accounts without having a valid phone number. Of course, it is possible to use a web service to receive the registration SMS, but that shouldn't be the case in the first place.
- kfk 3y agoFYI, the police is able to find criminals now by finding DNA sequences similarities with your relatives. Not saying this is good or bad, I am just saying you don't know the extent of the impact to your personal freedom when your relative's DNA is shared.
- HenryBemis 3y agoWell they can narrow it down to the family, unless it was the very DNA giver that left that DNA sample on the scene of the crime. And since 23andme (as I assume others) don't do these anonymously, there is no hope. Unless people use someone as a proxy (i.e. I-1 give my sample to a male colleague to send it as his-2, he-2 gives his sample to someone else to send it as his-3, and so on..). Police would eventually find the guilty in case of a crime, but the 23andme's of this world will be selling confusing (wrong) data.
- alexbeloi 3y agoFun fact, they can sometimes narrow down crime scene DNA to just a single person by having enough partial matches from their (potentially distant) relatives. I can't remember which DNA database was used, but some cases were solved this way, IIRC it introduced a bunch of legal questions about if you can search a database in that way. I think this was the article that talked about this (apologies for the paywall): https://www.nytimes.com/2021/12/27/magazine/dna-test-crime-identification-genome.html https://www.nytimes.com/2021/12/27/magazine/dna-test-crime-i...
- mrweasel 3y agoThere have also been a number of false positives because many believe that DNA is infallible. What people tend to forget is that DNA tests used by law enforcement is only using a very small subset of DNA markers. This mean that if you're already in a DNA database you can get an unpleasant knock on the door just because you have 10 DNA markers in common with some random criminal. Danish police only upgraded from 10 DNA markers to 16 in 2021, forcing them to review 12.000 cases and redoing the DNA test. Resulting in at least one person having the sentence reversed. No word on how many was falsely suspected, but I assume more than a few.
- yoaviram 3y agoSomething does not add up. "23andMe said the data breach was caused by customers reusing passwords" Yet 14,000 accounts were breached in one go? Where did these passwords come from? Maybe there was another related breach (something like lastpass can explain this)? Also, using the "DNA Relatives" features the hackers were able to access personal information relating to 6.9 million individuals. That means each one of the original 14,000 accounts had about 492 unique relatives. What am I missing?
- thaumasiotes 3y agoFor a breach to be caused by password reuse, it must be the case that a set of usernames and passwords got leaked somewhere else. If the usernames and passwords were leaked from 23andMe, that wouldn't be a breach related to password reuse, it would just be someone who found and cracked 23andMe's list of credentials. It isn't even slightly surprising that a list of credentials leaked from some other website (or a composite list built from leaks from several sites) might have 14,000 users in common with 23andMe.
- PeterisP 3y agoI don't find that surprising at all. There are publicly available large lists that compile many historical password breaches, they are easy for attackers (or anyone) to access and it's quite reasonable to expect that at least 0.1% of anyone's users (14k accounts out of 14m+ users) will be reusing a password that has been leaked elsewhere, unless you explicitly attempt to detect and invalidate such passwords e.g. as in yesterday's discussion on HN about Troy Hunt's work.
- llm_nerd 3y ago>Yet 14,000 accounts were breached in one go? That part isn't super surprising beyond the technical issue of the data usurpers probably not being metered or flagged for continuously logging into different accounts. They could have used a massively distributed network to pull all the data, but there probably simply wasn't the detection or protection. Having said that, in logging into my account to verify how many relatives are shown to add this response, 23andme refused to let me login and demanded that I reset my password because of password reuse. I have always had a very strong password on this account, and it isn't reused anywhere. I even have 2FA on. So it seems that the company isn't entirely comfortable with the notion that it was reused passwords behind it... However after resetting my password that I never reused anywhere, the DNA relatives panel shows 60 pages of relatives, with each having 25 relatives. So 1500 relatives could be pulled. Grabbing that for 14000 random accounts would be a pretty formidable network someone could build.
- meyum33 3y agoIn my country where the police has a LOT of power I'm more worried about inadvertently getting my relatives arrested for old closet crimes. Am I being too dramatic?
- Sebb767 3y agoIf the police has that much power, they'd probably just find another pretense to arrest your relatives, if the need to put pressure on you arises.
- kylehotchkiss 3y agoI bet a lot of insurance risk adjusters will make an order for the data, optimize their models a bit, raise a few rates, and make a few new millionaires in the process. I’m being snarky but isn’t it really scary that 2% of Americans could be impacted by something like that?
- austhrow743 3y agoIf you raise insurance rates then your customers can go elsewhere. You want a data edge over your competitors to lower rates.
- ribosometronome 3y agoThat sounds like an issue with the healthcare system rather than genetic analysis, no?
- mrtksn 3y agoIf anyone who used the service, do you know if you can use it anonymously? I wanted to try it but I was afraid of exactly this. How feasible it is to use a payment and an address that doesn't directly connect you to your samples?
- poyu 3y agoI signed up with fake name, delivered to a friends address, and a Privacy.com single use credit card. No one is forcing you to use real credentials anywhere online.
- mrtksn 3y ago> No one is forcing you to use real credentials anywhere online. Definitely not true, many services require KYC and others do it to prevent fraud.
- fsckboy 3y agothere is no credential more comprehensively solid than your genome
- mtlmtlmtlmtl 3y agoYeah it's sort of like using Tor to log in to Facebook and expecting Facebook not to know who you are because your IP is obscured.
- mrtksn 3y agoMore like using Tor to create a FB account with made up information and expecting FB not know who you are because your IP is obscured and you use fresh browser profile. In your DNA doesn't tell your identity, there's DNA everywhere and it's not something hard to come by. The analysis is only valuable if can be connected to a persona, otherwise its just chemical reaction.
- mtlmtlmtlmtl 3y ago
- DeathArrow 3y agoCool, now they can hack the DNA of millions and transform them into frogs or something.
- read-talumud 3y ago[flagged]
- t4lm00d-reader 3y ago[flagged]
- taurath 3y agoHow much does that have to do with their TOS update which went out on thanksgiving DAY (the most perfect time to get lost in everyone’s inboxes). The TOS update somehow tries to forbid class actions, requires you to go through an “informal” 60 day process before any legal action, and forces you into binding arbitration. Functionally you as a customer have next to no legal rights, according to 23andMe lawyers who cooked this up.
- helsinkiandrew 3y agoIf 6.9M users were to start arbitration proceedings - 23andMe might prefer a class action lawsuit.
- martin_a 3y agoDoes this hold up in court? At least in Germany any contracts that are heavily in favor of one side will be declared void if it comes to court.
- Cthulhu_ 3y agoI'm not a lawyer so I can't answer the question, but it will defintely complicate going to court, and I'm confident that the company has more lawyers and more money for lawyers than the average user. A class action suit may follow, but only if enough people and lawyers are willing, and it'll likely end up with a pittance in damages paid in a settlement, eventually.
- onetimeuse92304 3y agoWhat really interests me is "Are ToS changes absolutely binding?" I am also not a lawyer. But I think there are two types of changes to ToS. One is purely administrative. For example, they might change the methods available to reach for support. For example, they might say that you are no longer able to send a Fax to get support help. Or that their domain name changed. Second is something that changes the service that you are receiving. For example, when you have bought their product they said "we are offering free support for all owners or our doodad". But then one day they decide that support is now paid option for all existing customers. So the question is: can ToS changes that changes the service/product that you have already paid for binding without your consent? If they decide to introduce extra protection from class action, requirement for arbitrage, etc. is this just administrative or is it actually changing the service you are receiving by restricting your rights?
- 23B1 3y ago"Luckily we are now offering a genome monitoring service. For only $79.99 per month you can be sure that you're alerted any time someone tries to access your genetic record!" - 23andMe
- eimrine 3y agoThe scumbags received what they deserve. Just don't be a 23andme's used.
- yashasolutions 3y agoIt does feel at this point that any company collecting data will be hacked, it's only a matter of "when" and no "if"...
- eimrine 3y agoThey even don't need to be hacked if the Government wants to receive/alter the data.
- prawn 3y agoPenalties should be strong enough that sites and apps do not collect more than an email address without very good reason. Just wanting to contact me with marketing literature is not a good reason.
- Lio 3y agoI can't help but think that we need is for a class action suit to impose strong enough penalties that insurance companies to insist on proper audits of what data is actually needed and what is just a financial loss waiting to happen.
- wahnfrieden 3y agoNot because it’s hard work to protect themselves. But because it’s typically not a business priority (at top middle and via coercion and incentives, the bottom/workers too) to invest in security. Most of these big hacks are via well known threats that can be caught in typical good-faith auditing
- al_be_back 3y agothere was a craze for DNA analysis 10+ years ago, the idea being 'if we can analyze e-commerce transactions, why not the human DNA!' The UPS being mostly around Health than Ancestry. That's flopped in my view. Recent Gnome sequencing research is revealing that actually a Gene (downstream) doesn't necessitate a Health/Medical Condition (upstream) [1]. I think we need highest security measures, user education and Regulation when it comes to DNA, medical records, and biometric data (face, finger, iris, voice etc). Charles Darwin & Co documented their theory of evolution well, there's enough ancestry there for most i think, at least as a solid starting point / platform. My guess would be if there was more education around theory of evolution (science), there would be less interest in Ancestry services (DNA based), leaving only a Medical case for them, and hence demanding greater protection/security. [1] A biological relativity view of the relationships between genomes and phenotypes, Denis Noble - https://doi.org/10.1016/j.pbiomolbio.2012.09.004 https://doi.org/10.1016/j.pbiomolbio.2012.09.004
- spacecadet 3y agoIm sure someone just gave them access... Given the number of SE attacks on dumbass SaaS companies, seems easy when they all cut corners and overwork everyone...
- spacebacon 3y agoIt's imperative to recognize that the healing of cross-generational trauma is a journey within an individual's lifetime, rather than resorting to a confrontational approach that employs genetic data to incriminate individuals based on what science implies about their genetic makeup. The flaws inherent in this data—biased, widespread, and contaminated—highlight its unreliability. Relying on such data, which historically proves to be often incorrect, represents a narrow perspective. Using it to calculate high probabilities for targeting individuals in specific scenarios fosters more animosity than extracting genuine, overarching truths.
- e2le 3y agoI struggle to understand what is written here.
- cdolan 3y agoMe too but I think OPs point is “this was a pointless product in the first place, and can only lead to harm”
- spacebacon 3y agoYeah
- spacebacon 3y agoSorry, if Google didn’t make so many world changing products so quickly I’m sure I would have less criticism of Google in general and fit in more easily here.
- mkl 3y agoDoes what you wrote have something to do with Google? I don't see it.
- deleted 3y ago[deleted]
- major505 3y agoWell, it was a matter of time before something like that happened.
- nroets 3y agoIsn't it time governments start to regulate passwords ? (They already regulate a lot of privacy issues like medical and financial history. Some governments even regulate the use of finger print authentication of employees) For example, any website that allows users to choose normal, easy to remember passwords should meet a long list of requirements: For example security audits, bug bounties, capital reserves to deal with class action suits. Then small websites will start either implement Open ID or encourage their users to use password manages.
- stef25 3y ago> Isn't it time governments start to regulate passwords ? Nah we're good. They already regulate cookies and it's a dumpster fire.
- mclightning 3y agodumpster fire for who?
- concordDance 3y agoUsers constantly having to reclick on popups.
- stef25 3y agoand they don't understand what they're clicking, and they have no transparency.
- nroets 3y agoCookie consent is just a nuisance. Like the cancer warnings in California.
- deleted 3y ago[deleted]
- koheripbal 3y agoThat would not have protected 23andme from this issue. Password complexity does not stop password reuse.
- mikewarot 3y agoI never seriously considered using 23 and me. Not because of hackers, but rather what government would do with that information. I don't want to be responsible for some random relative getting charged with a crime just because I was curious about my family tree.
- knallfrosch 3y agoIf that's your only concern, you need to read up on something called "Nazis." Imagine what they would do with a database of genetic information.
- pfdietz 3y agoThey'd populate the database by making participation compulsory.
- maximus-decimus 3y agoImagine what a racist government would do if they were able to tell who's black! Sure, now they can start hating on people who have the gene that makes Cilantro taste like soap, but a lot of genetic things are already visible so I don't see this as being fundamentally different.
- ribosometronome 3y agoThat Nazis could use something for truly evil purposes is hardly limited to this but, I think, the concern is. You can imagine nazis transporting Holocaust victims and soldiers by rail, because they did, but I’ve never heard anyone argue against adding more rail infrastructure because if Nazis take over they could use the rail infrastructure to enable genocide.
- kzrdude 3y agoBoth railways and population registries were blown up by anti-nazi sabotage and resistance groups during WWII. So place your data like your railways, where you can blow em up when circumstances necessitate it.
- anotheraccount9 3y agoHow convenient.
- mensetmanusman 3y agoNice data for a super biological weapon though.
- mclightning 3y agoimagine the next hitler... as an immigrant with his data on 23andme, I am pretty scared. I am sure 1 out of the 10 ethnicities that I am affiliated with, will be eventually hated by some group.
- gcanyon 3y ago<puts on tinfoil hat> Does anyone think privacy of any real sort is maintainable going forward? Machine learning algorithms are learning to identify people just by their walk -- no face recognition required. Algorithms are moving toward being able to decipher text just by the audio of the keyboard being typed on. In short, given a gestalt of ALL public data and sufficiently advanced algorithms is there really a way for people to maintain what we today consider reasonable privacy without extraordinary measures, unfailingly applied? To be clear, I'm not value-judging the situation, just expressing what I think the ongoing trend is.
- wimp 3y agoPrivacy is a policy issue, not a technical issue. We need to focus on advocating for more useful and effective privacy protections as citizens, instead of focusing on technical evasion strategies. Because as you're pointing out, that is a losing strategy in the long run.
- dylan604 3y ago> Does anyone think privacy of any real sort is maintainable going forward Probably not, but it doesn’t mean we can’t guide the conversations about how it looks in the future. Sitting idly by just means they win, but discussing it in the open means that we might be able to put some safe guards in place. Oh, who am I kidding. We’re all screwed and evilCorp will win so we’re just wasting our energy and making ourselves crazy fighting. Resistance is futile
- pembrook 3y agoAgreed, but also "privacy" is an abstraction that layers over the actual thing that people are worried about. Any answer to why do you care about hiding this information? can all be boiled down to the fear that "[person or group] might use [private data item] to create [bad outcome] for me." So the thing people actually care about is the risk of bad outcome, not the actual data itself. If your theory is correct, then the focus should be on the prevention of asymmetric power imbalances in societal transactions that can even create [bad outcome].
- 3y ago
- bartwr 3y agoSomething super creepy that happened to me recently: a hospital where I've been to a few months ago called me and asked me to participate in some DNA analysis program. They said "oh and the best part? You don't need to do anything! We will use blood samples we collected the last time." I obviously declined, but it was a huge wtf to me - they stored biological samples associated with me without informing me and can do a post hoc DNA analysis. This is just insane and a proof of how non existent any privacy laws in the US are. (In EU they cannot freeze any samples without consent and unfrozen ones are ok for at most a few days)
- me_me_me 3y agoWell they did call you and tried to trick you into letting them use it. But assuming they obey the law they did not used your samples. So there are privacy laws in place? Also they could have been cleaning old results/samples and this was one step.
- bartwr 3y agoHow do I know they didn't use them? They already did something with my biological samples (storing for a different purpose than when they drew my blood) without my consent nor informing me. And also - could eg. police use it?
- me_me_me 3y agoI am not sure, only guessing. But why would they ask for permission in the firs place? > They already did something with my biological samples I can only guess you were tested for something in the hospital. Samples are sent to the lab (separate department) to be tested. If additional tests need to be perform they can use the blood they already received. The samples are kept for ready availability if additional tests are requested by doctor. Doctors dont care how its done, they dont have time to inform lab patient x is out home. After some time they need to be destroyed - due to expiry date on it. Before destroying the lab contacted you and asked for dna permission. > And also - could eg. police use it? I don't know that. But you might want to check how medical data is protected in your jurisdiction.
- madethemcry 3y agoSmall world. Only yesterday I read that great comment from user adameasterling about credential stuffing in another thread [1] > Troy Hunt is such a treasure. And for us web application developers, there is no excuse for not having protection against credential stuffing! While the best defense is likely two-factor, checking against Hunt's hashed password database is also very good and requires no extra work for users! That user even listed 23andMe [2] as an example but it's from 60 days ago. This incident is referenced on the techcrunch article. [1] https://news.ycombinator.com/item?id=38521106 https://news.ycombinator.com/item?id=38521106 [2] https://news.ycombinator.com/item?id=37794379 https://news.ycombinator.com/item?id=37794379
- T3RMINATED 3y ago[dead]
- harha_ 3y agoI really want to see information about my DNA. So it's very tempting to just give in, pay and send a sample to something like 23andMe...
- AndyMcConachie 3y agoSo people in my family have used 23andMe but I'm assuming my data is also compromised. I've never used the service because I think it's kind of weird and gross. But it probably doesn't matter that much if both of my parents and my brother have. Health insurance companies in the future can still charge me different prices based on my risk profile.
- pbhjpbhj 3y agoIf the data exists, it's going to get out. In this case the data is your genome. I was thinking about getting a DNA testing kit for my parents and my conclusion was that I'd have to advise them that they'd need to be comfortable with their genome being public because over time leaks are inevitable. As the UK marches on towards increased fascism the chances a Tory government will demand access to such data "for security purposes" gets higher.
- exo762 3y ago23andMe should be destroyed, including all copies of its database. I hope EU will fry them.
- sandos 3y agoHow about every other site that does, more or less, the same thing?
- jmount 3y agoSo the original "14000" leak is 0.1% of the customers, but now 6.9M is claimed. 14000/6900000 ~ 0.2%, so now half the customers are indirectly leaked?
- sandos 3y agoYes, likely at different levels. For example, if I log into my myheritage account, I have 27000 DNA matches which I can download a .csv of, which includes the matching parts. I can also access the trees of those users that share theirs. This really does not include personal data, _except_ the information about where our DNA is identical or half-identical. Which has potentially far-reaching implications, but the personal data should not really be available here, unless people has opted in to sharing it. Since its a site about sharing data, its not weird that its easy to extract data from it. It is sort of the purpose.
- codeulike 3y agohaveibeencloned dot com
- no-reply 3y agoOnly $24,799.00 + transfer fee, get yours today! /s
- agnosticmantis 3y agoCan we (folks who didn't use 23&me but may still be affected because our relatives might have) file a class action lawsuit? We haven't signed any licensing agreements with 23&me waiving our privacy, so presumably we still have some rights?
- deleted 3y ago[deleted]
- solardev 3y agoIf the hackers could "leak" this data to the public, it would be a tremendous genetic dataset for future generations of pirate researchers...
- bohadi 3y agovery regretable and very predictable
- hirvi74 3y ago23andMe is just pissed that someone or a group of hackers stole the same data they were selling to other companies.
- DueDilligence 3y ago[dead]
- deadmanbloopers 3y ago[flagged]
- ratsmack 3y ago>“We believe that the threat actor may have then, in violation of our terms of service, accessed 23andme.com accounts without authorization and obtained information from those accounts.” It's funny that they had to note "without authorization".
- zogrodea 3y agohttps://www.wired.co.uk/article/23andme-genetics-palestine https://www.wired.co.uk/article/23andme-genetics-palestine
- 1B05H1N 3y agoHow did they not notice 7 million accounts being accessed through credential stuffing? Do they have 0 fraud prevention? I doubt the attackers cycled IPs.
- renewiltord 3y agoI uploaded my genome to a public database. And it's higher fidelity than this. My children will, too. This isn't a really big deal to me. Hopefully, my DNA (as part of the big database) will help us find out something about humans in the future.
- ssgodderidge 3y ago23andMeandHackers
- henry2023 3y agoThis won't change until our government starts punishing (not 10M fines) hacked companies for leaking private data.
- macinjosh 3y agoYou can't punish a corporation, it is a collective and most members of it are worker bees told what to do without a big picture. You have to punish the members of the C-Suite individually if any change is to be seen.
- zlg_codes 3y agoFamily members should be able to sue for the loss of their genome's privacy. Data that isn't about you doesn't actually belong to you.
- deleted 3y ago[deleted]
- dang 3y agoRecent and related: 23andMe hackers accessed a whole lot of personal data - https://news.ycombinator.com/item?id=38519466 https://news.ycombinator.com/item?id=38519466 - Dec 2023 (36 comments) Hacker leaks millions more 23andMe user records on cybercrime forum - https://news.ycombinator.com/item?id=37931383 https://news.ycombinator.com/item?id=37931383 - Oct 2023 (394 comments) 23andMe Sued over Hack of Genetic Data Affecting Thousands - https://news.ycombinator.com/item?id=37895586 https://news.ycombinator.com/item?id=37895586 - Oct 2023 (20 comments) 23andMe Accounts Hijacked and Data Put Up for Sale on Hacker Forum - https://news.ycombinator.com/item?id=37810755 https://news.ycombinator.com/item?id=37810755 - Oct 2023 (2 comments) 23andMe says user data stolen in credential stuffing attack - https://news.ycombinator.com/item?id=37794379 https://news.ycombinator.com/item?id=37794379 - Oct 2023 (298 comments)
- 2dvisio 3y agoAnd still no communication from 23andme for those that could have been affected. Just a prompt about changing your password.