23andMe Sued over Hack of Genetic Data Affecting Thousands | Hacker News Reader

23andMe Sued over Hack of Genetic Data Affecting Thousands

news.bloomberglaw.com

33 pointsjruohonen20 comments

To clarify, there was no breach of 23andMe's system. Instead, individual users had their accounts hacked (e.g. password reuse), and the "DNA relatives" feature from 23andMe means you can see information about others who are a DNA match to you.

But you choose what you get to share in the first place. If you're willing to share that info to any rando who comes up as a DNA relative, is that data really considered that private to begin with?

> To clarify, there was no breach of 23andMe's system.

Is this solid information? A lot of different stories in media. For instance, WP reported that there was a breach. Some other stories report a 1M-7M breach.

Another thing, of course, is that the company blatantly violates the GDPR and related laws:

"But during the account deletion process, 23andMe tells users that the company and its partner lab will hang onto your “genetic information, date of birth and sex,” after your account is deleted, per state and federal legal requirements, according to two 23andM3 users, who shared screenshots of the deletion process with The Post."

https://www.washingtonpost.com/technology/2023/10/12/23andme...

https://therecord.media/scraping-incident-genetic-testing-si...

> Is this solid information? A lot of different stories in media. For instance, WP reported that there was a breach.

I have not seen a single article reporting that there was an actual compromise of 23andMe's security systems. If you have any examples, please share. I have seen articles calling this a "data breach" (TFA calls it that), but it always leads to details saying it was just normal credential stuffing.

Sure: we can debate what amounts as "a breach to a system".

If personal data leaks through credential stuffing, scraping, or whatever, I still call it a breach personally.

Then literally every consumer-facing tech company suffers "data breaches" continually, every day. The distinction isn't just important - without it, the word has no viable meaning.

That's not a breach IMO. That's improper user security.

yep, should have enabled 2fa by default

Assuming so, I'm surprised these high-profile folks are re-using passwords:

> Some of the information has appeared for sale online, including that of prominent figures such as Mark Zuckerberg, Elon Musk and Sergey Brin, according to a press account cited in the lawsuit.

Or one of their relatives is reusing passwords.

To use a different authentication flow you need to change your habits and a bit of discipline, because it's extra friction.

I imagine Mark and Elon aren't too scared about their life insurance rate increasing.

Your account has been hacked. We strongly advice you to change your DNA.

This is clearly a scheme by Big Biology to sell more DNA

Maybe people will someday learn to not trust arbitrary companies with their genetic and other data.

I just don't think it's truly personal information if they can link to you base on your cousin's DNA.

I see it the same as something like your height, race and sex. It's not exactly something you can hide easily.

Plus you leave a trail of it behind wherever you go! Just like fingerprints.

This "hack" is overplayed. Someone simply grabbed shared passwords from previously compromised accounts from hacks of other compromised websites, and scraped the DNA relatives.

This doesn't amount to leaks of raw genetic data

“we value the trust of our study participants and by ensuring their data privacy now we can all reap the long-term benefits of this research.”

https://edu.google.com/why-google/customer-stories/fimm-gcp/

It was clear that sooner or later there would be a leak, hack or end up in the government hands.

But they stated the raw genetic data was not accessed?

Reply on news.ycombinator.com