Hackers got nearly 7M people's data from 23andMe
theguardian.com
theguardian.com
Lots of these things are sold on the dark web and they might release snippet samples to get a buyer but my understanding is that unlike the old days of hacking....they normally don't release the entire stolen content unless they really believe in totally free data, or they have some massive gripe with the company.
Normally only those who paid get access and iirc the guy who got into the 23&me company wanted like a shitload of money for the entire dataset which was massive. I heard the entire data was somewhere between 20 and 50 terabytes but I could have wread an estimate.
you can trade Fullz on the darkweb or you can gun for the whole dataset
wholesale is cheaper than retail
the hacking economy distributes risk the same way corporations do, the person making the hack isnt the person using the hack, isnt the person selling the hacked data, isnt the person using the hacked data
It probably died down because when you strip the sensationalism from the stories it comes down to this.
1. Bad guys took leaked emails and passwords that were leaked from other sites and tried them on 23andMe.
2. 14000 of those people in those leaks from other sites had 23andMe accounts and used the same email and password at 23andMe.
3. That gave the bad guys access to everything on those accounts.
4. 23andMe has an opt in feature that shows you all your relatives on 23andMe who have also opted in. "Relative" means people out to 4th cousins. Mine has 1500, although I suspect that the average is more like 700.
5. The majority of 23andMe users opt in to relative sharing. This is not surprising since finding relatives is one of the major reasons people use DNA testing services.
6. If you are on 23andMe and opted into relative sharing, and any one of your relatives who also opted in is one of the 14000 from #2, then the bad guys can see your name, geographical area, and DNA relationship to your relative from #2 on that person's relatives list.
7. That turns out to be about 7 million people.
Thanks for clearing that up.
This is not what happened here. 23&Me exercised poor security. I deal with financial data for my job, (like, transactional data, for most Americans), and I would consider that less sensitive than DNA data. We lock that transactional data up so tight it'd make your head spin. If it's data about an individual, in the wrong hands, it can do harm. If you're in the business of people's data, you cannot be stupid about protecting that data. 23&Me is (was) very much in the business of people's data, and could afford and attract the best talent to ensure the data was encrypted and protected.
They're reaping what they sowed.
The bad guys obtained user passwords from breaches at other sites where some 23andMe users had accounts and had used the same email and password as their 23andMe account. They logged into those 23andMe accounts and obtained data that those accounts had access to.
What looks "normal" depends on the org, but 23&Me knows what it is (or should, since it's a fundamental of running their business).
Just as a made up example, they may know that 85% of users don't use VPNs, and typically have an IP address that geolocates within 100 miles of their mailing address (which 23&Me has on file). Users might also typically log in very infrequently between 12-4am (localized to their IP/mailing address). And when they do log in, 90% of the time it's to see the new content you just sent a marketing email about, with short session lengths as well.
A user who logs in through an IP that geolocates well outside of their mailing address and methodically steps through every possibly thing you can click on at 3:15AM, is probably a bad actor who gained access through credential stuffing attacks.
Off the shelf tools can automatically detect all of that kind of behavior, and more. They can look at the collective traffic patterns and see a bunch of users logging in from the same pool of IPs, or the same VPN, or around the same time, or using the site in the same way as others bearing similar attributes. They can stop wide spread coordinated attacks from botnets.
The same tools can automatically detect and alert when credential stuffing attacks are happening, locking down accounts and requiring their passwords to be reset.
Given the scale at which 23&Me operated, it's impossible that they weren't aware of these tools.
Investing in the right tools is just one of many things they could have done. Even with those kinds of tools, you need to assume they're not enough (even if they are), so you encrypt everything at rest. Every decryption gets audited, and audit logs get fed into the same monitoring tools used to alert and stop abnormal behavior.
It all sounds overkill, but remember: they lost 91% of their valuation. All it took was the wrong people getting in, and it tanked their entire business.
That's why this data breach is so dangerous. It helps fill in nearly every stepping stone for bad actors, all the way to the baddest of them, to cause harm or exploit someone.
Isn’t that what all of these “I did my DNA and you’re my dad!” and “Ancestry.com cold crime DNA break” stories prove?