Genetic Testing Site 23andMe Confirms Hackers Accessed Ancest Data of Nearly 7 Million Users
The genetic testing website 23andMe has confirmed that almost seven million of its users had their DNA ancestry information compromised in a security breach that occurred in early October. As a result, their sensitive information was accessed by hackers who obtained “a significant number of files containing profile information about the users’ ancestry.” Engadget first reported the news.
A regulatory filing from December 1 confirmed that personal data from 0.1 percent of the site’s customers—totaling roughly 14,000 people—was accessed by “threat factors.” On December 2, 23andMe spokesperson Katie Watson confirmed to TechCrunch that hackers had obtained the private information of about 5.5 million people. The numbers were inflated because of 23andMe’s DNA Relative opt-in feature, which allows relatives to contact one another through the site.
Because those profiles contained the personal information of their relatives, the actual number of registrants exposed was closer to 6.9 million, which is just under half of the site’s 14 million reported users. The company also admitted the further 1.4 million users who opted into the DNA Relative feature “had their Family Tree profile information accessed.” That information includes birthdates, self-reported locations, relationship statuses, and usernames.
When 23andMe disclosed the hacking incident in October, they said the breach was due to customers reusing old passwords from other sites. Hackers obtained these in data leaks from other companies and were then able to access the users’ other accounts.
Experts say the best way to avoid your personal information being compromised in a data leak is to change your passwords often, and not reuse the same one on too many different sites. “A lot of it just comes down to the fact that humans reuse their passwords—that's what makes [data breaches] possible,” Ronnie Tokazowski, a digital scams researcher, told Wired in October.
