{"id":170730,"date":"2023-10-09T12:03:11","date_gmt":"2023-10-09T06:33:11","guid":{"rendered":"https:\/\/dripp.zone\/news\/?p=170730"},"modified":"2023-10-09T12:03:11","modified_gmt":"2023-10-09T06:33:11","slug":"genetic-data-stolen-from-23andme-in-credential-stuffing-attack-crypto-news","status":"publish","type":"post","link":"https:\/\/dripp.zone\/news\/genetic-data-stolen-from-23andme-in-credential-stuffing-attack-crypto-news\/","title":{"rendered":"Genetic Data Stolen from 23andMe in Credential Stuffing Attack – Crypto News"},"content":{"rendered":"
\n

Genetic testing company 23andMe is investigating a data breach that exposed customer information, including profile photos, birth years, and ancestry details of millions of its users.<\/p>\n

The compromised data was obtained through unauthorized access to individual 23andMe accounts, the company said in a statement reported by Ars Technica<\/i><\/a>. Preliminary results suggest the login credentials used to access the accounts \u201cmay have been gathered by a threat actor from data leaked during incidents involving other online platforms where users have recycled login credentials,\u201d 23andMe said.<\/p>\n

The technique, known as credential stuffing, involves using usernames and passwords exposed in previous breaches to break into other online accounts.<\/p>\n

\n
\n

Following a claim that someone had gained access to and is selling certain 23andMe customer data, we conducted an investigation. We have not identified any unauthorized access to our systems. We will continue to monitor the situation.<\/p>\n

\u2014 23andMeSupport (@23andMeSupport) October 4, 2023<\/a><\/p>\n<\/blockquote>\n<\/div>\n

23andMe said in a blog post<\/a> that it has no evidence of an actual breach of its systems. \u201cWe do not have any indication at this time that there has been a data security incident within our systems,\u201d the company wrote.<\/p>\n

According to Wired<\/i><\/a>, the breach specifically targeted users of Ashkenazi Jewish heritage. Hackers posted an initial data sample on the platform BreachForums earlier this week, claiming it contained 1 million data points exclusively about Ashkenazi Jews.<\/p>\n

The data was obtained by scraping profile information of relatives connected through 23andMe’s \u201cDNA Relatives\u201d feature, which allows customers to connect with genetic matches on the platform. By accessing compromised accounts, the hacker could amass profiles of related users who had opted into sharing their information.<\/p>\n

\u201cWe believe that the threat actor may have then, in violation of our terms of service, accessed 23andme.com accounts without authorization and obtained information from those accounts,\u201d explained 23andMe in its blog post.<\/p>\n

On hacking forums last week, an unknown user advertised the sale of 23andMe user data, claiming to have obtained information on over 7 million customers. The leaked data included \u201cfull names, usernames, profile photos, sex, date of birth, genetic ancestry results, and geographical location,\u201d according to BleepingComputer<\/i><\/a>.<\/p>\n

Another forum user reportedly offered access to 23andMe profiles in bulk, with prices ranging from $1 to $10 per account.<\/p>\n

23andMe did not disclose details on the number of users impacted or the extent of the data leak. But according to Ars Technica<\/i>, one database contained 1 million customers of Ashkenazi Jewish heritage, while a second held 300,000 user profiles of Chinese ancestry.<\/p>\n

Security experts have repeatedly cited the risks of compromised genetic data<\/a>. \u201cYour DNA is the most valuable thing you own,\u201d warned<\/a> the U.S. National Counterintelligence and Security Center in February 2021. \u201cIt holds the most intimate details of your past, present and potential future \u2014 whether you are prone to addiction or high-risk for cancer.\u201d<\/p>\n

“Losing your DNA is not like losing a credit card,” the center continued. “You can order a new credit card, but you cannot replace your DNA. The loss of your DNA not only affects you, but your relatives and, potentially, generations to come.”<\/p>\n

23andMe said it reported the breach to law enforcement and encouraged customers to reset passwords and enable two-factor authentication.<\/p>\n

\u201cWe actively and routinely monitor and audit our systems to ensure that your data is protected,\u201d 23andMe said. \u201cWhen we receive information through those processes or from other sources claiming customer data has been accessed by unauthorized individuals, we immediately investigate to validate whether this information is accurate.\u201d<\/p>\n

The genetic testing company, which offers insights into ancestry and health risks based on DNA analysis, has amassed genetic data on more than 14 million customers since its founding in 2006.<\/p>\n

23andMe said the leaked data did not contain any genomic details. But privacy advocates have long raised concerns about the sensitivity of DNA analysis results and ethnic data being compromised in a breach.<\/p>\n

The 23andMe breach comes amid a wave of major cyber attacks exposing sensitive user information. Last year, 10.9 million accounts were leaked in total, with 10 accounts being leaked every second, according to<\/a> digital privacy firm Surfshark.<\/p>\n

Editor’s note: This story was drafted with Decrypt AI from sources referenced in the text, and\u00a0fact-checked<\/span>\u00a0by Ozawa.<\/i><\/p>\n

\n
<\/p>\n

Stay on top of crypto news, get daily updates in your inbox.<\/h3>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

Genetic testing company 23andMe is investigating a data breach that exposed customer information, including profile photos, birth years, and ancestry details of millions of its users. The compromised data was obtained through unauthorized access to individual 23andMe accounts, the company said in a statement reported by Ars Technica. Preliminary results suggest the login credentials used […]<\/p>\n","protected":false},"author":2,"featured_media":170731,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[230,225,221,227,226,228,229,60,223,224,222],"class_list":["post-170730","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cryptocurrency","tag-brave","tag-coinbase","tag-crypto","tag-decentralised","tag-decentralized","tag-decentralized-exchange","tag-erc-20","tag-featured","tag-meme-coin","tag-robinhood","tag-solana"],"_links":{"self":[{"href":"https:\/\/dripp.zone\/news\/wp-json\/wp\/v2\/posts\/170730","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dripp.zone\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dripp.zone\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dripp.zone\/news\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/dripp.zone\/news\/wp-json\/wp\/v2\/comments?post=170730"}],"version-history":[{"count":2,"href":"https:\/\/dripp.zone\/news\/wp-json\/wp\/v2\/posts\/170730\/revisions"}],"predecessor-version":[{"id":170733,"href":"https:\/\/dripp.zone\/news\/wp-json\/wp\/v2\/posts\/170730\/revisions\/170733"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/dripp.zone\/news\/wp-json\/wp\/v2\/media\/170731"}],"wp:attachment":[{"href":"https:\/\/dripp.zone\/news\/wp-json\/wp\/v2\/media?parent=170730"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dripp.zone\/news\/wp-json\/wp\/v2\/categories?post=170730"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dripp.zone\/news\/wp-json\/wp\/v2\/tags?post=170730"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}