4 ms·

Something does not add up. "23andMe said the data breach was caused by customers reusing passwords" Yet 14,000 accounts were breached in one go? Where did the

Something does not add up. "23andMe said the data breach was caused by customers reusing passwords" Yet 14,000 accounts were breached in one go? Where did these passwords come from? Maybe there was another related breach (something like lastpass can explain this)? Also, using the "DNA Relatives" features the hackers were able to access personal information relating to 6.9 million individuals. That means each one of the original 14,000 accounts had about 492 unique relatives. What am I missing?

thaumasiotes 3y ago
For a breach to be caused by password reuse, it must be the case that a set of usernames and passwords got leaked somewhere else. If the usernames and passwords were leaked from 23andMe, that wouldn't be a breach related to password reuse, it would just be someone who found and cracked 23andMe's list of credentials. It isn't even slightly surprising that a list of credentials leaked from some other website (or a composite list built from leaks from several sites) might have 14,000 users in common with 23andMe.
PeterisP 3y ago
I don't find that surprising at all. There are publicly available large lists that compile many historical password breaches, they are easy for attackers (or anyone) to access and it's quite reasonable to expect that at least 0.1% of anyone's users (14k accounts out of 14m+ users) will be reusing a password that has been leaked elsewhere, unless you explicitly attempt to detect and invalidate such passwords e.g. as in yesterday's discussion on HN about Troy Hunt's work.
llm_nerd 3y ago
>Yet 14,000 accounts were breached in one go? That part isn't super surprising beyond the technical issue of the data usurpers probably not being metered or flagged for continuously logging into different accounts. They could have used a massively distributed network to pull all the data, but there probably simply wasn't the detection or protection. Having said that, in logging into my account to verify how many relatives are shown to add this response, 23andme refused to let me login and demanded that I reset my password because of password reuse. I have always had a very strong password on this account, and it isn't reused anywhere. I even have 2FA on. So it seems that the company isn't entirely comfortable with the notion that it was reused passwords behind it... However after resetting my password that I never reused anywhere, the DNA relatives panel shows 60 pages of relatives, with each having 25 relatives. So 1500 relatives could be pulled. Grabbing that for 14000 random accounts would be a pretty formidable network someone could build.
quickthrower2 3y ago
Genghis Khan got hacked?
- RcouF1uZ4gsC 3y ago
  I think Genghis Khan usually did the hacking… With a sword.
tgv 3y ago
14000 accounts <-> 7M users? That ratio is a bit skewed.
- nickthegreek 3y ago
  Its because you can get some data if you opt in to relationship tracking. For instance, my 23andme shows like 1,500 genetic relatives. So saw you are jewish and opt-in to this feature. The person can login to the account and see X amount of other jewish people and their names. This is the data that was stolen from my understanding. Not the actual raw DNA of those individuals. With the current gaza/israel issue, you can see why someone having a list of the names of thousands of Jewish people might cause some concern.
tzs 3y ago
Seems plausible to me, assuming that my situation on 23andMe is about average when it comes to the number of DNA relatives and the vulnerability of my relatives to being hacked. A quick search says 23andMe has 14 million customers, so 14000 accounts breached would be 1 in 1000 accounts breached. The DNA relatives listing for me lists just over 1500 people. If each of those accounts had a 1/1000 probability of being hacked, the probability none of my relatives were hacked would be (1-1/1000)^1500 = 0.223. The probability that at least one of my relatives was hacked would then be 0.777. I'd then expect, based on my assumption that I'm typical, about 10.8 million people to have had relatives with hacked accounts, which is close enough to 6.9 million that the latter seems plausible.
semitic-bad 3y ago
[flagged]

thaumasiotes 3y ago

For a breach to be caused by password reuse, it must be the case that a set of usernames and passwords got leaked somewhere else. If the usernames and passwords were leaked from 23andMe, that wouldn't be a breach related to password reuse, it would just be someone who found and cracked 23andMe's list of credentials. It isn't even slightly surprising that a list of credentials leaked from some other website (or a composite list built from leaks from several sites) might have 14,000 users in common with 23andMe.

PeterisP 3y ago

I don't find that surprising at all. There are publicly available large lists that compile many historical password breaches, they are easy for attackers (or anyone) to access and it's quite reasonable to expect that at least 0.1% of anyone's users (14k accounts out of 14m+ users) will be reusing a password that has been leaked elsewhere, unless you explicitly attempt to detect and invalidate such passwords e.g. as in yesterday's discussion on HN about Troy Hunt's work.

llm_nerd 3y ago

>Yet 14,000 accounts were breached in one go? That part isn't super surprising beyond the technical issue of the data usurpers probably not being metered or flagged for continuously logging into different accounts. They could have used a massively distributed network to pull all the data, but there probably simply wasn't the detection or protection. Having said that, in logging into my account to verify how many relatives are shown to add this response, 23andme refused to let me login and demanded that I reset my password because of password reuse. I have always had a very strong password on this account, and it isn't reused anywhere. I even have 2FA on. So it seems that the company isn't entirely comfortable with the notion that it was reused passwords behind it... However after resetting my password that I never reused anywhere, the DNA relatives panel shows 60 pages of relatives, with each having 25 relatives. So 1500 relatives could be pulled. Grabbing that for 14000 random accounts would be a pretty formidable network someone could build.

quickthrower2 3y ago

Genghis Khan got hacked?

RcouF1uZ4gsC 3y ago
I think Genghis Khan usually did the hacking… With a sword.

tgv 3y ago

14000 accounts <-> 7M users? That ratio is a bit skewed.

nickthegreek 3y ago
Its because you can get some data if you opt in to relationship tracking. For instance, my 23andme shows like 1,500 genetic relatives. So saw you are jewish and opt-in to this feature. The person can login to the account and see X amount of other jewish people and their names. This is the data that was stolen from my understanding. Not the actual raw DNA of those individuals. With the current gaza/israel issue, you can see why someone having a list of the names of thousands of Jewish people might cause some concern.

tzs 3y ago

Seems plausible to me, assuming that my situation on 23andMe is about average when it comes to the number of DNA relatives and the vulnerability of my relatives to being hacked. A quick search says 23andMe has 14 million customers, so 14000 accounts breached would be 1 in 1000 accounts breached. The DNA relatives listing for me lists just over 1500 people. If each of those accounts had a 1/1000 probability of being hacked, the probability none of my relatives were hacked would be (1-1/1000)^1500 = 0.223. The probability that at least one of my relatives was hacked would then be 0.777. I'd then expect, based on my assumption that I'm typical, about 10.8 million people to have had relatives with hacked accounts, which is close enough to 6.9 million that the latter seems plausible.

semitic-bad 3y ago

[flagged]