23andMe confirms hackers stole ancestry data on 6.9M users

Personally speaking, I think Equihax was the better counter-argument; at least with 23andme YOU as a customer had to DECIDE to use their services and weigh the pros-cons of doing so, with Equihax I was forced into a rating system to determine my eligibility in a system that hoovers up any and all data sold to them by 3rd parties and holds all my personal information in order to complete anything from a loan application to a job application.

And when found to have been breached no effective recourse was made, and instead of admitting fault to a very high probability of Identity theft being the end result a token 'credit system monitoring' service was offered, which once again relies on these credit agencies who share/distribute this information without my consent and created the problem are let off scot-free and never suffer any consequences.

In short, it's a naive argument made from often ignorant and self-defeating practices that make others worse off because of their complacency and refusal to take privacy serious.

The stolen data included the person’s name, birth year, relationship labels, the percentage of DNA shared with relatives, ancestry reports and self-reported location.

While I agree it's a perfect counter-argument to that, is that what people always say? I'm not sure I've heard that argument as much as "why do you care so much about privacy?" full stop. As in, they don't really understand why anyone should care about privacy. And this isn't really a counter argument to that, any more than any other breach. And to be fair it's not really even a counter argument to that until you show the harm that came from it. What do you think will happen to people who had their ancestry data stolen here?

I think it is difficult for some people to think about abstract ideas. When you bring it to the physical world everyone understands it is vexing.

Absent that, the argument holds that screeching declarations about privacy tend to be overblown.

At least in Germany any contracts that are heavily in favor of one side will be declared void if it comes to court.

> We encourage you to read the new terms in full. Please notify us within 30 days of receiving this email if you do not agree to the terms, in which case you will remain subject to the current Terms of Service. If you do not notify us within 30 days, you will be deemed to have agreed to the new terms.

Notification email: legal@23andme.com

Probably not, but it doesn’t mean we can’t guide the conversations about how it looks in the future. Sitting idly by just means they win, but discussing it in the open means that we might be able to put some safe guards in place.

Oh, who am I kidding. We’re all screwed and evilCorp will win so we’re just wasting our energy and making ourselves crazy fighting. Resistance is futile

Any answer to why do you care about hiding this information? can all be boiled down to the fear that "[person or group] might use [private data item] to create [bad outcome] for me."

So the thing people actually care about is the risk of bad outcome, not the actual data itself.

If your theory is correct, then the focus should be on the prevention of asymmetric power imbalances in societal transactions that can even create [bad outcome].

Turns out the UK government was working on privacy-preserving walks decades ago: https://youtu.be/eCLp7zodUiI

About a decade ago I knew people researching computer vision algorithms doing non-facial recognition (stuff like ear shape/gait/etc) because companies like Fortinet were trying to build "automated doormans" to apartment/condo complexes where they would scan and analyze any humans walking by the cameras placed at the door.

Not a lick of ethics from anyone involved.

What we need is rabid legislation that encodes a right to be forgotten, because clearly an expectation of privacy isn't enough. I don't think there's anything inherently wrong with automating identification, but I do think there's a lot wrong with companies trying to do it for every human being that they can possibly find without any consent.

People are easy to mislead and so that's what's been done. In the future, privacy will have to be enforced through jammers and Faraday cages.

None of the gait and keyboard detection attempts work in field conditions.

1) the large hack of Optus in which about half of the population had their credit card details stolen. 2) the large hack of Medibank in which the details of a large portion of private health insurance customer details were stolen. 3) I applied for a mortgage and found out every 2-bit mortgage broker is emailed 100s if not 1000s of sensitive ID documents every year and they definitely do not go through their email and delete them after the closure of deals. 4) Most companies in Australia only require a name, address, and, birth date to verify identity which is easily found with five minutes of searching most of the time. 5) I set up a pin with Telstra that should have blocked administrative changes on my account for years. One day I called in, got my password ready, and they didn’t ask for it. They just did it anyway. It was entirely futile.

IMO the only way that privacy will ever become respected is if we move the onus for fraud onto the actual victims of fraud: the companies. This is the whole ancient joke about someone’s identity being “stolen”. It wasn’t stolen, your verification procedures ultimately failed as a business and you are trying to divert responsibility to avoid having to suffer a loss. This is one of the reasons I use my credit card exclusively these days - if it used fraudulently I know that I can charge back, and that’s about the only mechanism I can use to truly prevent unauthorised access to my money.

But assuming they obey the law they did not used your samples.

So there are privacy laws in place? Also they could have been cleaning old results/samples and this was one step.

Predictably?, amusingly? police never had access to this data, until a government minister was murdered in 2003, when a sample from the suspect was retrieved. From what we know it has not been used since. So we can be cynical, but under the circumstances, the police use of the registry has not yet taken hold and is guarded by the courts..

It isn't even slightly surprising that a list of credentials leaked from some other website (or a composite list built from leaks from several sites) might have 14,000 users in common with 23andMe.

That part isn't super surprising beyond the technical issue of the data usurpers probably not being metered or flagged for continuously logging into different accounts. They could have used a massively distributed network to pull all the data, but there probably simply wasn't the detection or protection.

Having said that, in logging into my account to verify how many relatives are shown to add this response, 23andme refused to let me login and demanded that I reset my password because of password reuse. I have always had a very strong password on this account, and it isn't reused anywhere. I even have 2FA on. So it seems that the company isn't entirely comfortable with the notion that it was reused passwords behind it...

However after resetting my password that I never reused anywhere, the DNA relatives panel shows 60 pages of relatives, with each having 25 relatives. So 1500 relatives could be pulled. Grabbing that for 14000 random accounts would be a pretty formidable network someone could build.

A quick search says 23andMe has 14 million customers, so 14000 accounts breached would be 1 in 1000 accounts breached.

The DNA relatives listing for me lists just over 1500 people. If each of those accounts had a 1/1000 probability of being hacked, the probability none of my relatives were hacked would be (1-1/1000)^1500 = 0.223. The probability that at least one of my relatives was hacked would then be 0.777.

I'd then expect, based on my assumption that I'm typical, about 10.8 million people to have had relatives with hacked accounts, which is close enough to 6.9 million that the latter seems plausible.

If the test was done, the results were sent, and then my test data/info were destroyed on their end, or if I could do a home test where the data never left my home, then I’d do it.

I struggle to understand why companies hold on to all this data. It is a huge liability. In this case, maybe it is so they can identify familial relationships, but is that feature worth the risk?

I'd recommend to use a fake name and not something like "Ano Nymous" as their rules don't allow that.

The exact info though should be easy to protect. Just dont give it away.

But remember that other close family members to you are very likely to know who you are, and they may share that info by accident. Normally you can't share data of anyone living on these services, since that is illegal pretty much anywhere, but its enough if one user happen to mark you dead in their tree and has filled in your real data.

Since its a site about sharing data, its not weird that its easy to extract data from it. It is sort of the purpose.

Danish police only upgraded from 10 DNA markers to 16 in 2021, forcing them to review 12.000 cases and redoing the DNA test. Resulting in at least one person having the sentence reversed. No word on how many was falsely suspected, but I assume more than a few.

Nah we're good. They already regulate cookies and it's a dumpster fire.

It is all outdated, written by people who thought they understood security in the 90's.

The French ANSSI recommendations are ridiculous. The German as well. Having an incompetent gov org forcing you to apply their "best practices" is terrible.

We have already for banks and look at what they have done: all possible "don't do it!" implementations neatly on one page (source: Boursobank, Fortuneo and other French banks who replay that the security is "reviewed by experts")

It is much healthier to offer genetic improvements for flaws than arbitrarily incriminate by way of dna makeup.