2y ago

23andMe says hackers gained access to data of about 6.9 million people

www.nbcnews.com

Genetic testing company 23andMe said Monday that hackers were able to access the data of about 6.9 million people, far more than the company previously acknowledged.

The finding is the result of an investigation 23andMe launched in October, after at least one list of people whom the site identified as having Ashkenazi Jewish ancestry was posted online.

42 comments

If I needed anymore convincing that you shouldn't just give your genomic data away forever to shady companies for "FuN tRiViA" about your ancestry, this is certainly it
- No one could ever explain to me what the point of these are, except that they can say now that they are 11% Italian. It's like a online iq test with spit.
  
  i dunno a lot of history is about human diaspora for different reasons. people are allowed to be interested in their history and shouldn't have to worry about this kind of bullshit
  
  I think 23nMe looks into genome related predisposal to health issues. Like "this sequence here is related to high probability of pancreatic cancer" or some bullshit like that.
  In the hands of hackers, I guess it could be used to target individuals for highly specific scams or something like that. That's only what I can think of though. Who knows what they'll use it for and if it even has identifiable personal info past just ancestry.
  The tinfoil hat theory is that this info could be used to charge extra for insurance premiums/denial of coverage...
  
  In Canada it's more like 11% First Nations, Inuit or Metis ... so white people can play pretendian.
  
  After my gma and gpa had Alzheimer's, we (mom, me, brother) did it to see if we had the genetic markers for increased risk for the disease.
  Bonus: we also found out we have a half sister on Dad's side that we did not know about that was born the year after Mom and dad divorced, and Dad also didn't know about her,. or so he says. So that was informative.
Captain Obvious was hiding for a while. Now, he runs with your most personal data. Even your kids will thank you in coming years for whatever behavior, diseases, IQ or political preferences will be found to be rooted in genomic data. The world will know theirs.
Edit: Oh, and you‘ll help your family members to be jailed, if somehow involved in criminal acts.
- Oh, and you‘ll help your family members to be jailed, if somehow involved in criminal acts.
  The police have been using that data to solve crimes for years. That's how they found the golden state killer and others.
  https://www.seattletimes.com/seattle-news/law-justice/dna-family-tree-help-solve-52-year-old-seattle-slaying/
  Public genealogy databases, which contain information from people who have obtained their DNA profiles from companies like 23andMe and Ancestry.com, have become a powerful police tool...
  
  Autocorrect is not your friend.
Who can have possibly have foreseen this happening repeatedly?
If you have a pile of gold it can only be stolen once. After that you no longer have it. If you have data it can be "stolen" an infinite number of times since each time you still have it.
It's truly a shame that in this advanced age of technology, encryption remains a distant, unattainable dream! In this archaic age of ours, safeguarding customer data is just not possible yet because nobody has ever invented the concept of public private key pairs yet, and hackers are having a field day with our data. Clearly, we're still stuck in the digital dark ages where safeguarding sensitive information is just a pipe dream. 🙄
Seriously, how is it possible that they're still not using key pairs for encrypting this data? It would be so simple, you just include a flash drive, or a qr code, in the box with the key and accessing the website to view the data would require that key, how is that still not something they're doing?
#EncryptionPlease
- They accesed the data through compromised accounts. What do you think encryption would have done?
  
  that has nothing to do with it, you just give each user a private key, and in order to view the data you need the key, simple as that, in fact it's even simpler for a user, no passwords to remember
- If they encrypt it, how will they sell them to third parties
- because I'm pretty sure they need some of that data to be unencryped;
  records of related customers can improve accuracy drastically
  ~~and they're probably also probably selling it~~
  also this "hack" was done by just abusing built-in features ("dna relatives" system), not actually breaking any security.
  
  because I’m pretty sure they need some of that data to be unencryped; records of related customers can improve accuracy drastically
  I don't even think this should be a feature, but, if it has to, then they can have two versions of it, one that they use for training and improving the results and a user can only access their data from a frontend by decryping it (locally) with their key
  also this “hack” was done by just abusing built-in features (“dna relatives” system), not actually breaking any security.
  irrelevant. if you had a key pair no amount of password guessing would get them there
- A strange number of engineers think DARE and transmission encryption are sufficient for sensitive data, as though that encryption isn't effectively transparent if the tools designed to access it are compromised.
  
  Fair point!
  To be clear I wasn't arguing that DARE is enough, you are absolutely correct that depending on the situation it isn't, but in my opinion in this specific case. if the data was DAREd, and sent to the user in its encrypted state and only decrypted on the user's machine with the user's key, that's not stored in any server, it would have completely fixed this specific issue. Naturally, however, to your point, with encryption there is no one-size-fits-all argument!
In a just world they would be fined out of existence. The owners/CEO etc should spend time in prison.
I really wish I lived in a world society where this would not be a big deal and would actually be less likely to happen because there was no financial incentive to it.
- Is that the world where everyone's genome is openly available anyway or what scenario do you imagine?
  
  nope. a post scarcity world where the only reason someone would want the information is for specific purposes like a doctor or just a nosey snoop. Basically a world where anyone who would want to know would likely not be inclined to take the necessary work to bypass token safeguards.
Is anyone here not aware they've already been selling that data to insurance companies and who knows who else?
- Yaaaaay my dad with a horrible genetic disease did this shit I'm never going to be able to get life insurance ever
  
  Bonus points if you're living in a country where mortgage must come with a life insurance as a risk mitigataion - NOW YOU'LL NEVER OWN A HOUSE - YAAAYYY.
One of those events you could see from afar. It’s almost non news. You create a treasure trove of data, you can be sure it will be targeted and eventually, stolen.
- You are correct. Wait until one of the really large data collectors gets hacked, i.e. Google, Meta, etc. It's not if, but when.
Ni.ce
Nice.

42 comments