23andMe
- Nearly 7 million 23andMe users had their data stolen, with some of it for sale on the dark web.
- Hackers accessed the data with logins that were the same on other websites and already compromised.
- The stolen info included users' names, ancestry data, profile pictures, birth years, and locations.
Back in October, it came to light that customer data from DNA-testing company 23andMe was stolen and put up for sale on the dark web.
We now know exactly how many users were affected: Nearly 7 million.
A 23andMe spokesperson told Business Insider the hackers were able to directly access only a "very small percentage" of user accounts — 0.1%, or around 14,000 accounts — but nearly 7 million users had at least some their personal information accessed. 23andMe has around 14 million total users.
23andMe told BI that, according to its investigation, the hackers gathered the stolen data with a technique called credential stuffing. This involves using user credentials that were exposed in past data breaches — for example, if someone used the same login and password on another website as they used for their 23andMe account, and that login information from the other website was stolen and sold.
"Of note, we do not have any indication that there has been a breach or data security incident within our systems, or that 23andMe was the source of the account credentials used in these attacks," the 23andMe spokesperson told BI.
Through the 14,000 or so user accounts that were accessed directly, the hackers were also able to access the DNA Relatives profiles of around 5.5 million users who opted in to the company's DNA Relatives feature, which allows them to automatically share some of their information with other users.
An additional 1.4 million customers who had opted in to the feature also had their Family Tree profile information accessed, which 23andMe told BI is a limited subset of information available in the DNA Relative profile.
For the small subset of 14,000 who had their profiles directly accessed, the information available generally "included ancestry information, and, for a subset of those accounts, health-related information based upon the user's genetics."
Information accessed in the DNA Relatives profiles includes a user's display name, how recently they logged into their account, their relationship labels, and predicted relationships and percentage of shared DNA with their matched relatives on the website, 23andMe told BI. Information on these profiles might also include a user's ancestry reports, matching DNA segments with relatives, self-reported location in the form of city or zip code, birth locations and family names of ancestors, profile picture, and birth year.
The Family Tree profiles accessed could include all of same the information as the DNA Relatives profiles, excluding ancestry reports, percentage DNA shared with matched relatives, and matching DNA segment information.
23andMe told BI that it's "in the process of notifying affected customers." It's unclear exactly how many of the impacted users have already been notified by now, nor when the customer started notifying customers.
In the meantime, the company required on October 10 that all existing users reset their passwords, and began requiring two-step verification for all new and existing customers on November 6, according to an October filing with the SEC.
"The company will continue to invest in protecting our systems and data," the 23andMe spokesperson told BI.