Company “23 and me” hacked. DNA information on members and relatives released to web hackers

[John Galt]

From a CNN report via. Securities filing so this press release essentially comes direct from the company:

A Friday filing from 23andMe to the Securities and Exchange Commission said that about 0.1% of the company’s user accounts, or roughly 14,000, had their accounts breached by the hackers.

23andMe is standing by that number but is also now (12/5/23) telling reporters that the hackers were able to access some 5.5 million profiles that use a company feature called DNA Relatives that allows users to find genetic relatives. In addition, the hackers accessed a subset of family tree information on 1.4 million DNA Relatives profiles, the 23andMe spokesperson said in an emailed statement.

This reinforces my fear of these DNA testing companies and the data they possess. I know of a family that did this as a Holiday gift, a bit of a lark gift and lo and behold, it came back that one of the four kids was not from the father. And no, it was not an adoption, you can fill in what happened 20+ years ago….
How do you recover from that, both the kid and the family unit?

Has anyone here done DNA testing and had an unexpected finding from the results or perhaps, because of the information in the database, been contacted by someone claiming to be related.

My opinion - this DNA technology has the potential for so much good for diagnosis of medical conditions. It should have been developed. BUT the results should be be treated like medical records and kept secure.

 

[Pew]

My opinion - this DNA technology has the potential for so much good for diagnosis of medical conditions. It should have been developed. BUT the results should be be treated like medical records and kept secure.

DNA and genetic testing companies are under HIPAA regulations as well so theoretically they would have the same minimum cyber security requirements.

It looks like the issue was magnified even worse with this:
Because of the way that the DNA Relatives feature matches users with their relatives, by hacking into one individual account, the hackers were able to see the personal data of both the account holder as well as their relatives, which magnified the total number of 23andMe victims.

Who wants to bet it was some employee that clicked on an email attachment that they shouldn't have.

 

[goingplacesanddoingstuff]

Hackers hackers or “hackers”? Get my drift?

 

[vpr5703]

DNA and genetic testing companies are under HIPAA regulations as well so theoretically they would have the same minimum cyber security requirements.

It looks like the issue was magnified even worse with this:
Because of the way that the DNA Relatives feature matches users with their relatives, by hacking into one individual account, the hackers were able to see the personal data of both the account holder as well as their relatives, which magnified the total number of 23andMe victims.

Who wants to bet it was some employee that clicked on an email attachment that they shouldn't have.

This has a surprising amount of similarity to the Cambridge Analytica scandal that happened on facebook. Where Cambridge Analytica was able to steal data from other people's Facebook accounts due to links within the friend system.

 

[nwjones18]

we got these from relatives one year for Christmas and the wife and I did it. I have regretted it ever since.. water under the bridge though.

 

[BMWTurboDzl]

From a CNN report via. Securities filing so this press release essentially comes direct from the company:

A Friday filing from 23andMe to the Securities and Exchange Commission said that about 0.1% of the company’s user accounts, or roughly 14,000, had their accounts breached by the hackers.

23andMe is standing by that number but is also now (12/5/23) telling reporters that the hackers were able to access some 5.5 million profiles that use a company feature called DNA Relatives that allows users to find genetic relatives. In addition, the hackers accessed a subset of family tree information on 1.4 million DNA Relatives profiles, the 23andMe spokesperson said in an emailed statement.

This reinforces my fear of these DNA testing companies and the data they possess. I know of a family that did this as a Holiday gift, a bit of a lark gift and lo and behold, it came back that one of the four kids was not from the father. And no, it was not an adoption, you can fill in what happened 20+ years ago….
How do you recover from that, both the kid and the family unit?

Has anyone here done DNA testing and had an unexpected finding from the results or perhaps, because of the information in the database, been contacted by someone claiming to be related.

My opinion - this DNA technology has the potential for so much good for diagnosis of medical conditions. It should have been developed. BUT the results should be be treated like medical records and kept secure.

Even medical records aren't secure. The most secure network you can find is one which is 100 percent self-contained.

 

[vavavroom]

I would love to voice my views but I'm not ready for a BITOG-sponsored permanent vacation.

 

[bbhero]

Even medical records aren't secure. The most secure network you can find is one which is 100 percent self-contained.

We had a major security breach at the hospital I worked at… It had to have been massive because my supervisor sat all of us down and talked to us about it.

 

[vpr5703]

Even medical records aren't secure. The most secure network you can find is one which is 100 percent self-contained.

And even then - It's only as secure as the people operating it. Just look at what happened with STUXNET.

 

[BMWTurboDzl]

we got these from relatives one year for Christmas and the wife and I did it. I have regretted it ever since.. water under the bridge though.

Serial killer in the family eh?

 

[brianl703]

Because of the way that the DNA Relatives feature matches users with their relatives, by hacking into one individual account, the hackers were able to see the personal data of both the account holder as well as their relatives, which magnified the total number of 23andMe victims.

That personal data is only what a 23andme user can see. That would include ancestry, maybe their location (if they filled it out) maybe the name (some users don't have their full name on there), and maybe some info about their surnames and family tree if they've bothered to fill it out.

 

[atikovi]

Never understood all this obsession over privacy on medical records. I get that people don't want embarrassing conditions made public, but who cares if some total stranger doing hacking of thousands of records sees you were treated for VD or 'roids. I'd think someone that got your SSN would do more damage.

 

[John Galt]

That personal data is only what a 23andme user can see. That would include ancestry, maybe their location (if they filled it out) maybe the name (some users don't have their full name on there), and maybe some info about their surnames and family tree if they've bothered to fill it out.

My sister did this test and told us brothers that she filled in our family tree including our and our kids bio information on her submission.

I was livid! I felt personally violated but kept quiet for family unity. We had within the past 6 months lost our father, stepfather and our mother (to dementia) and a big fight over her 23 and me submission could have done irreparable harm.

That was a few years ago, I have never brought it up to her but without my permission my, through my sister, DNA information is in their database.

 

[vavavroom]

The keycards at work got compromised a few years ago because one employee couldn't keep his key card in his pants after hours. We all got a day off and shiny new key cards. We were also encouraged to guard our key cards as if we were hiding aliens in the basement - which we are not. They are off-site.

 

[brianl703]

My sister did this test and told us brothers that she filled in our family tree including our and our kids bio information on her submission

23andme doesn't have a family tree function. The most you can do is link your 23andme profile to another service that does, like Ancestry. Ancestry doesn't show family tree entries for living people. I have an Ancestry family tree and it only has direct ancestors of mine in it; I didn't put cousins, uncles, aunts, etc. in it.

That was a few years ago, I have never brought it up to her but without my permission my, through my sister, DNA information is in their database.

Where does it stop? Should a 1st cousin once removed of mine be angry with me that I submitted my DNA to Ancestry or one of the others?

 

[Hillbilly Deluxe]

This reinforces my fear of these DNA testing companies and the data they possess. I know of a family that did this as a Holiday gift, a bit of a lark gift and lo and behold, it came back that one of the four kids was not from the father. And no, it was not an adoption, you can fill in what happened 20+ years ago….
How do you recover from that, both the kid and the family unit?

I haven't heard much about these types of tests in years since the shine wore off.

It's always amazing what the bandwagon riders are always jumping on and lining up to do. This was one that blew my mind a few years ago, the typical, low-information, pop-culture experts were doing this in a rage.

Then the data comes back, ooops, one kid don't match. Or "honey, someone is knocking on the door"....

 

[Snagglefoot]

The Boys from Brazil......

 

[Hillbilly Deluxe]

Several of my friends and I were going to do the 23 and Me thing. We were all going to spit in a cup, mix it up and use that to swab and send it in under a President's name.

 

[John Galt]

23andme doesn't have a family tree function. The most you can do is link your 23andme profile to another service that does, like Ancestry. Ancestry doesn't show family tree entries for living people. I have an Ancestry family tree and it only has direct ancestors of mine in it; I didn't put cousins, uncles, aunts, etc. in it.



Where does it stop? Should a 1st cousin once removed of mine be angry with me that I submitted my DNA to Ancestry or one of the others?

Brian, I might be conflating the Ancestry site along with the 23 and me. She (my sister) applied/submitted whatever is appropriate to both sites and the same time. She was hopeful to find distant relatives that we did not know. My dad’s extended family tree was pretty much unknown to us and he was from a big family. My moms family tree was fairly well known. She wanted to know more.

She was just oblivious to the dark side potential of her action - watched too many Hallmark holiday movies I think.

 

[CKN]

Never understood all this obsession over privacy on medical records. I get that people don't want embarrassing conditions made public, but who cares if some total stranger doing hacking of thousands of records sees you were treated for VD or 'roids. I'd think someone that got your SSN would do more damage.

This is very true.

Brian, I might be conflating the Ancestry site along with the 23 and me. She (my sister) applied/submitted whatever is appropriate to both sites and the same time. She was hopeful to find distant relatives that we did not know. My dad’s extended family tree was pretty much unknown to us and he was from a big family. My moms family tree was fairly well known. She wanted to know more.

She was just oblivious to the dark side potential of her action - watched too many Hallmark holiday movies I think.

And what would that be? I had a relative I didn't know that was in my tree contact me. Wasn't a big deal. Of course maybe if you are related to Ted Bundy or Charles Manson or something.......

So what did she found out that was "dark" or "bad"? You opened the door-let's walk through it.