23andMe confirms hackers stole ancestry data on 6.9 million users

Submitted ⁨⁨11⁩ ⁨months⁩ ago⁩ by ⁨L4s@lemmy.world [bot]⁩ to ⁨technology@lemmy.world⁩

https://techcrunch.com/2023/12/04/23andme-confirms-hackers-stole-ancestry-data-on-6-9-million-users/

23andMe confirms hackers stole ancestry data on 6.9 million users::Genetic testing company 23andMe revealed that its data breach was much worse than previously reported, hitting about half of its total customers.

source

Comments

Sort:hotnew top

MataVatnik@lemmy.world ⁨11⁩ ⁨months⁩ ago
Would you let government collect DNA from people when they are born? Absolutely not, bit I will definitely give it to a silicon valley start up who will then proceed to sell it and have it stolen.

source
- aelwero@lemmy.world ⁨11⁩ ⁨months⁩ ago
  If you’re allowing a corporation to have it, you are giving de facto consent for government to collect it with zero regard for your rights whatsoever.
  
  They have the greatest ability to buy it, the greatest ability to steal it, and a fairly unique ability to confiscate it.
  
  source
  - pdxfed@lemmy.world ⁨11⁩ ⁨months⁩ ago
    Yeah but what about great aunt Marge? Don’t you want to know if it was Scotland or Denmark?!?
    
    source
  - MataVatnik@lemmy.world ⁨11⁩ ⁨months⁩ ago
    Good point with that last sentence.
    
    source
- abhibeckert@lemmy.world ⁨11⁩ ⁨months⁩ ago
  No I don’t see how government vs private makes any difference.
  
  A baby isn’t capable of informed consent, so their DNA shouldn’t be collected unless it’s required for some medical reason (and then the sample should be immediately destroyed and no records kept).
  
  source
- r3df0x@7.62x54r.ru ⁨11⁩ ⁨months⁩ ago
  I can very easily imagine a 23 year old liberal virgin technocratic atheist saying that DNA should be collected at birth to solve crimes. These are also the same people who likely support euthanizing disabled people if they “consent” to it.
  
  source
  - grandkaiser@lemmy.world ⁨11⁩ ⁨months⁩ ago
    Liberal? The “personal freedom from government” folks? I think you’re thinking of someone who is pro authoritarian. I could 100% see a tankie, fascist, or right-wing authoritarian agreeing with that.
    
    source
    -> View More Comments
Sir_Kevin@lemmy.dbzer0.com ⁨11⁩ ⁨months⁩ ago
My gf wanted so bad for me to send my DNA to these clowns. I declined due to privacy reasons. She tried to convince me that they keep your info private. I told her that even if that was true, the government could still access it. She thinks I’m paranoid. And now her personal info is likely part of this leak.

source
- merc@sh.itjust.works ⁨11⁩ ⁨months⁩ ago
  Lucky for you, if enough of your relatives send in their DNA they don’t need to get anything from you directly.
  
  source
- MuffinHeeler@aussie.zone ⁨11⁩ ⁨months⁩ ago
  My mother had breast cancer. I couldn’t get a test to see if it was the inheritable one because then I would have to disclose it as pre-existing for the rest of my life.
  
  This is just one example.
  
  What if in future, your insurance price depended on an inheritable diseases DNA clearance. You could refuse but then it would be $$$$$. What if my life insurance refused to pay upon my death because I had knowledge of a gene that causes cancer when I took out the policy?
  
  PS not American.
  
  source
  - AliasAKA@lemmy.world ⁨11⁩ ⁨months⁩ ago
    They’ll almost surely attempt this, but it will be much less clear cut on it. There’s federal law against discriminating on the basis of genetics, so they can’t explicitly charge more for it.
    
    But you better believe it’ll be a component in a deep learning insurance adjustment model that charges you more and just tells you the model says so — I’d expect this to occur and a court case to happen.
    
    source
  - realharo@lemm.ee ⁨11⁩ ⁨months⁩ ago
    That’s a situation for a government program, not insurance. Insurance is for situations where it’s unlikely that you’ll need a payout.
    
    Of course people today have to deal with the systems we have, but I’m talking about your hypothetical “future” scenario.
    
    source
- SCB@lemmy.world ⁨11⁩ ⁨months⁩ ago
  
  I told her that even if that was true, the government could still access it. She thinks I’m paranoid. And now her personal info is likely part of this leak.
  
  You’re paranoid and she’s probably part of the leak.
  
  The odds the government gives any kind of shit about your 23 and me data, much less could competently do anything with it, are vanishingly small. That’s just pure paranoia.
  
  source
  - curious_betsy@lemmy.world ⁨11⁩ ⁨months⁩ ago
    Sadly very much not true, the government is very much interested in your DNA data. Check out this article about how they caught the golden state killer
    
    Law enforcement officials are more interested in whether their perp is closely related to other people in the database
    
    source
  - phoenixz@lemmy.ca ⁨11⁩ ⁨months⁩ ago
    Not really… this info can and is being used in solving crimes. That and, if the US government ever turns into a dictatorship (hello trump!) then you won’t have to worry of being put on a list, you are already on one.
    
    source
    -> View More Comments
- Animated_beans@lemmy.world ⁨11⁩ ⁨months⁩ ago
  If you’ve ever had blood work done at the doctors office or had any tissue removed, your DNA is almost certainly on file somewhere. Human specimens are very valuable in research so whatever isn’t needed for testing is sent off to various research facilities. There really aren’t laws about tissue ownership so medical facilities can do whatever they like without your permission, though some still ask. Source: “The Immortal Life of Henrietta Lacks”
  
  source
  - AliasAKA@lemmy.world ⁨11⁩ ⁨months⁩ ago
    This is only partially true. Due to things like Henrietta Lacks cells (HeLa cells for those working in cell culture), we actually have informed consent around this. They can’t just use your samples for not consented collection purposes (though in some cases, the further testing may fall under the original consent)
    
    HHS rules note:
    
    “If the tissues are identifiable, then subjects must provide consent for the secondary use and that consent must cover the elements of consent in 21 CFR 50.25.”
    
    That really only applies to healthcare providers covered under FDA and HIPAA regs.
    
    Obligatory not a lawyer etc.
    
    source
  - echodot@feddit.uk ⁨11⁩ ⁨months⁩ ago
    Yeah my blood’s already on file, that way after the fall of human civilisation people can clone me to find out what happened and I get to live.
    
    source
- ugh@lemm.ee ⁨11⁩ ⁨months⁩ ago
  What is your concern with doing a DNA spit test? I’m honestly curious, because I haven’t heard an actual answer yet. I don’t see how it exposes any more information compared to what advertisers already have.
  
  source
  - Snapz@lemmy.world ⁨11⁩ ⁨months⁩ ago
    Is this a serious question? Advertisers don’t know that you carry a gene that means you may prematurely die? They’d like to know though, so they can feed you life insurance scams when they know you’re vulnerable, “last chance” style round the world cruises, last will and testament legal services and of course pharmaceuticals. They also want to target your loved ones while they know they’re especially vulnerable after you’ve loss. They want to send your spouse widows dating apps and psychic hotlines, etc. Advertising is knowing your specific weaknesses/vulnerabilities and exposing you to your triggers in your most vulnerable moments,for profit.
    
    Also, this data is correct, and it’s Data that can/will be used to deny people health coverage/insurance/jobs in the future. Also a potential tool to reveal layers of ethnic heritage they would make the nazis drool (look into how IBM did a version of this for the nazis to use the census to help enable the historic scale of that genocide). With trump potentially around the corner and other rising fascist powers worldwide, and the only way trump stays out of jail is to remain president indefinitely and “silence” his detractors, it’s just too much sensitive data to be amassed, especially by a poorly regulated private company. Also makes your DNA vulnerable to cups gaining access eventually and bringing you in as suspect for crimes you didn’t commit and, especially in places like Texas, executing you.
    
    Better question is, why are you on the side of this topic that you’re on?
    
    source
  - n0m4n@lemmy.world ⁨11⁩ ⁨months⁩ ago
    Have any of your blood relatives had any diseases that have a genetic component? Cancer? Heart disease? Yeah, we don’t cover that, it’s as clear as day, in the fine print, on page 13,131 of indexed addendum information. Additionally, you knowingly had this information from a DNA test, which constitutes fraud, making your policy null and void. Thank you for your business.
    
    source
    -> View More Comments
  - Thorny_Insight@lemm.ee ⁨11⁩ ⁨months⁩ ago
    For me the reason is the same than with all collection of personal data on social media. There is no any one specific scenario I’m worried about per se, but it has more to do with the potential for misuse in the future. I hate to compare things to nazies but it’s the best example I can come up with. Just imagine what a goldmine facebook user data would’ve been to them. There’s always the possibility for a fascistic government of some kind to take power one day and a database containing these amounts of personal information of near every person alive has near infinite possibilities to be misused. I couldn’t possibly imagines all the ways this information could be used against me but it can and thus the safest way is to prevent them from having the data in the first place. It’s sort of an insurance. You hope that it will not be needed and it probably wont but going completely without is pretty irresponsible too.
    
    source
    -> View More Comments
  - geophysicist@discuss.tchncs.de ⁨11⁩ ⁨months⁩ ago
    Advertisers have my preferences and buying and watching habits, my DNA is… my DNA. That’s another whole level
    
    source
    -> View More Comments
  - coffeebiscuit@lemmy.world ⁨11⁩ ⁨months⁩ ago
    Insurance companies would love your DNA too, for all the “good” reasons. And imagine not getting a job because of your DNA.
    
    Zipcodes can do just so much…
    
    source
    -> View More Comments
  - ook_the_librarian@lemmy.world ⁨11⁩ ⁨months⁩ ago
    What happens the worst that can happen when you give your DNA to a privite company? Delta Airlines will frame you for murder.
    
    source
    -> View More Comments
- r3df0x@7.62x54r.ru ⁨11⁩ ⁨months⁩ ago
  I wonder how many people like this turn around and then use electronic payments in person for everything.
  
  source
  - Duamerthrax@lemmy.world ⁨11⁩ ⁨months⁩ ago
    Different levels of privacy. Electronic payments only reveal what you buy and at least serves a utility. 23andme is just for vanity and could reveal your preexisting conditions or family tree to people who would use it against you.
    
    source
    -> View More Comments
slumberlust@lemmy.world ⁨11⁩ ⁨months⁩ ago
Didn’t they originally try to brush this off as credential stuffing and aggregation?

There should be harsher penalties around mishandling people’s data, especially if you lie about it to save face.

source
SexualPolytope@lemmy.sdf.org ⁨11⁩ ⁨months⁩ ago
Good thing that these things haven’t really taken off in my country. Otherwise, you don’t even need to submit your DNA. If enough of your stupid relatives do it, they’ll have a good idea about you.

source
- _Mantissa@lemmy.world ⁨11⁩ ⁨months⁩ ago
  That might be true about DNA data but these places gather every public genealogy record available. If your country has a census, for example, they probably already know more about your family then you do.
  
  source
- r3df0x@7.62x54r.ru ⁨11⁩ ⁨months⁩ ago
  My uncle did this and I found out that I’m 3% Irish. As a Gamer, this is a Clayton Bigsby moment.
  
  source
Oha@lemmy.ohaa.xyz ⁨11⁩ ⁨months⁩ ago

data on 6.9 million users

Nice.

source
- Welt@lazysoci.al ⁨11⁩ ⁨months⁩ ago
  The dot in between the 6 and the 9 is their dead baby.
  
  source
- RagingRobot@lemmy.world ⁨11⁩ ⁨months⁩ ago
  I assume that’s just all their users
  
  source
- cybermass@lemmy.ca ⁨11⁩ ⁨months⁩ ago
  Was looking for this one
  
  source
tsonfeir@lemm.ee ⁨11⁩ ⁨months⁩ ago
Instead of them selling it.

source
- aelwero@lemmy.world ⁨11⁩ ⁨months⁩ ago
  Supposedly not selling it…
  
  source
  - Lucidlethargy@sh.itjust.works ⁨11⁩ ⁨months⁩ ago
    Supposedly Facebook runs a really clean and straightforward operation, too. I hear banks are really generous as well.
    
    I hear bitcoin investors only want to decentralize currency, too. It’s def not a scam. Totes legit. Let’s all go buy lots of bitcoins! Who wants monkey nfc’s and exploding kittens nfc’s!?
    
    source
    -> View More Comments
  - tsonfeir@lemm.ee ⁨11⁩ ⁨months⁩ ago
    Sorry, “donations” like a church. Dirty government money is tax free
    
    source
Nurse_Robot@lemmy.world ⁨11⁩ ⁨months⁩ ago
So I got an email today telling me that I would automatically accept their new ToS (which included barring me from class action lawsuits without 1-2 months of arbitration), but I could email them to refuse the change and keep the old ToS. I emailed them to refuse the change, was that a mistake?

source
- abhibeckert@lemmy.world ⁨11⁩ ⁨months⁩ ago
  I find it hard to believe “not responding to an email” is consent. I mean they can write that in an email but there’s no way it would hold up in court.
  
  source
  - treefrog@lemm.ee ⁨11⁩ ⁨months⁩ ago
    If the original contract has provisions for changing it in this manner then it might hold up in court.
    
    What I’m curious about is if my brother’s DNA was stolen. Do I have the right to sue for negligent handling of data that’s as much his as mine?
    
    source
    -> View More Comments
  - blazeknave@lemmy.world ⁨11⁩ ⁨months⁩ ago
    It’s typical in software.
    
    source
- Haha@lemmy.world ⁨11⁩ ⁨months⁩ ago
  No
  
  source
- TechAnon@lemm.ee ⁨11⁩ ⁨months⁩ ago
  Not a mistake, but their ToS change without consent probably wouldn’t stand up in court.
  
  source
bladerunnerspider@lemmy.world ⁨11⁩ ⁨months⁩ ago
Two days ago they sent an update to their TOS that they will require arbitration and to reply to their legal department to “opt out”.

source
- Nurse_Robot@lemmy.world ⁨11⁩ ⁨months⁩ ago
  I got the email from 23 and me about changing their terms of service as well (wordy for search engine optimization). I opted out of the change
  
  source
  - blazeknave@lemmy.world ⁨11⁩ ⁨months⁩ ago
    Thank you. Done.
    
    source
- db2@sopuli.xyz ⁨11⁩ ⁨months⁩ ago
  Probably not legal, but if it doesn’t get challenged…
  
  source
CitizenKong@lemmy.world ⁨11⁩ ⁨months⁩ ago
And this, children, is why we don’t give deeply personal data to companies.

source
frogfruit@sh.itjust.works ⁨11⁩ ⁨months⁩ ago
So hackers can have my info, but I can’t have a copy of my own data.

source
FlyingSquid@lemmy.world ⁨11⁩ ⁨months⁩ ago
Hey, at least they weren’t put in the Jewish Database.

source
DirkMcCallahan@lemmy.world ⁨11⁩ ⁨months⁩ ago
Yet more evidence that we shouldn’t be handing over sensitive data to random companies. Will this change anyone’s behaviour? Sadly, probably not.

source
- ugh@lemm.ee ⁨11⁩ ⁨months⁩ ago
  I struggle to see what someone could do with that information. My ethnicity is already known by the government and every advertiser collecting my information online. I randomly had my identity connected to my cousin’s before any family took DNA tests. Her name would show up in those questionnaires along with what car I’ve owned and where I’ve lived when I had to go through online government stuff.
  
  I’m relatively paranoid about giving out personal information, but I don’t consider my spit very sensitive.
  
  source
  - cman6@lemmy.world ⁨11⁩ ⁨months⁩ ago
    You get a phone call from someone claiming to be from 23andme but they’re not…
    
    Hi it’s Jim from 23andme. Just going through security with you. You did a test with us on the 5th Dec, your mother is X and your father is Y. Ok that confirms who I am. So as I said it’s Jim and in your results we see you have a genetic condition which means you will have early onset dementia. We offer a preventative treatment. Want to enrol in the trial? It’s $200.
    
    Not the best example I admit but an example of how that data could be misused and you’ve just paid “Jim” $200
    
    source
  - ExLisper@linux.community ⁨11⁩ ⁨months⁩ ago
    What I would do is search for data where the kid is not biological child of both parents. For all the cases I found I would send automated email to both parents saying that if they don’t pay me I will reveal this info to their child, post it on their facebook and email all their friends. How many couples do you think found out that there was a mixup in the in vitro clinic or simply that there was some cheating and didn’t reveal it to everyone My guess is more than 0.
    
    Or I would email everyone on the list saying that I analysed their data and found that there’s 100% probability they are gay/trans/have a small dick. Out of the 7 million, how many would believe it and pay not to have this revealed?
    
    With 7 million users it’s more about running scams than getting ‘dirt’ on the individuals.
    
    source
  - r3df0x@7.62x54r.ru ⁨11⁩ ⁨months⁩ ago
    There is a lot of job discrimination in hiring of autistic people, especially when it’s hard to fire them.
    
    Many places actively profile for it and consider symptoms to be red flags since they can’t explicitly ask. This is why making it hard to fire people hurts the disadvantaged.
    
    source
  - TechAnon@lemm.ee ⁨11⁩ ⁨months⁩ ago
    It sucks as a whole. Imagine having everyone’s DNA. You can develop things that hurt a specific set of people only. It may or may not affect you directly, but it affects our communities. You’re right as an individual. No one really cares about your hair or spit and if they did, it’s very easy to get a hair sample in most cases without you even knowing it. As technology gets better there will be (maybe already are ways) to get your DNA that are less intrusive or need less material. AI trained on DNA and physical attribute could probably narrow it down A LOT using video alone.
    
    source
    -> View More Comments
nymwit@lemm.ee ⁨11⁩ ⁨months⁩ ago

The stolen data included the person’s name, birth year, relationship labels, the percentage of DNA shared with relatives, ancestry reports, and self-reported location.

23andMe also confirmed that another group of about 1.4 million people who opted-in to DNA Relatives also “had their Family Tree profile information accessed,” which includes display names, relationship labels, birth year, self-reported location and whether the user decided to share their information, the spokesperson said.

This is of course bad but is everyone thinking that actual DNA information was copied or what? That’s what it seems like from y’all’s comments. I mean that’s a pretty easy leap to make, it’s a DNA testing company after all, but they seem pretty specific on what data got out. I don’t immediately see that this specific information is worse than say what a credit reporting agency has on you.

source
- Pyr_Pressure@lemmy.ca ⁨11⁩ ⁨months⁩ ago
  I can see someone nefarious blackmailing people that discovered they accidentally married their long lost sister or those who found out their father cheated on their mother or something.
  
  source
- banneryear1868@lemmy.world ⁨11⁩ ⁨months⁩ ago
  The relatives thing is weird anyway. I took the 23andMe test and downloaded my raw data and wrote a script to find different marker values. The other info I provided the site probably isn’t accurate. Don’t really care if someone gets my DNA markers either cause DNA isn’t like what most people think it is.
  
  source
echodot@feddit.uk ⁨11⁩ ⁨months⁩ ago
Why? I mean they’re all dead why would you want to have this information how was it useful how are they going to use it?

source
- MeatPilot@lemmy.world ⁨11⁩ ⁨months⁩ ago
  Time traveling hackers.
  
  Their goal? To travel back in time and establish the first spam marketing service before the FCC established guidelines to restrict spam and before the discovery of the telephone!
  
  source
  - Meowoem@sh.itjust.works ⁨11⁩ ⁨months⁩ ago
    That’s ridiculous, it’s obvious they’re just normal hackers who are doing the very standard thing of collecting family connections and relationship data so they can locate the true scion of Jesus and unlock the secrets of the holy grail. It’s what all the scam centers and bot armies do.
    
    source
speaker_hat@lemmy.one ⁨11⁩ ⁨months⁩ ago
It also happene in 2019 to a similar company called MyHeritage: twitter.com/haveibeenpwned/…/1098327769660850176

source
TransSynthesist@lemmy.blahaj.zone ⁨11⁩ ⁨months⁩ ago
The hackers were the US Govt. /s maybe

source
nucleative@lemmy.world ⁨11⁩ ⁨months⁩ ago
This is so predictable. Large databases are valuable targets for theft.

It seems like the vulnerability at 23 was users who used the same password on another site.

Presumably the attackers had those databases (easy to obtain peeps, thats why we use different passwords and password managers) and a good script that let them login and download. Probably over a whole lot of proxy IPs, so it was hard for 23 to see that they were under attack for a while.

Don’t know what else to say… Maybe 2 factor authentication should be more common. I guess with them you could spit on your monitor and it should log you in.

If that’s the only issue it seems a bit of a far reach to say they were breached.

source
guriinii@lemmy.world ⁨11⁩ ⁨months⁩ ago
Oh no, they know I’m 7.2% French.

source
- sciencesebi@feddit.ro ⁨11⁩ ⁨months⁩ ago
  You’re not. It’s all fake
  
  source
  - HaggierRapscallier@feddit.nl ⁨11⁩ ⁨months⁩ ago
    Sort of, but it depends on the interpretation.
    
    source
fart_pickle@lemmy.world ⁨11⁩ ⁨months⁩ ago
There should be a mandatory test or exam before allowing companies to handle user data. And it should be perpetual.

source
notannpc@lemmy.world ⁨11⁩ ⁨months⁩ ago
Ah, so they’ll miss out on a few sales of all that genetic data people pay them to collect. Boohoo.

source