Get all your news in one place.
100’s of premium titles.
One app.
Start reading
TechRadar
TechRadar
Sead Fadilpašić

23andMe hackers accessed a whole lot of user's personal data

Zero-day attack.

Biogenetics company 23andMe has submitted a new filing with the U.S. Securities and Exchange Commission (SEC) detailing the data breach it suffered in early October 2023.

In the filing, the company said that the threat actors accessed data on 0.1% of its customer base - roughly 14,000 individuals if the company's recent claim to have “more than 14 million customers worldwide” in a recent annual earnings report is to be believed. 

But it gets a bit more complicated than that. 23andme is a genetics testing and ancestry company and sometimes users share this data with other accounts via the “DNA Relatives” feature. Consequently, the attackers accessed “a significant number of files containing profile information about other users’ ancestry that such users chose to share.”

Credential stuffing

The explanation is vague, so we don’t know exactly how many files were accessed, or how many “other users” were affected.  But what is known is that a threat actor tried to sell millions of data pieces belonging to 23andMe on the dark web. The company later confirmed the data’s authenticity, saying a hacker most likely used credential stuffing (trying an infinite amount of username/password combinations) to access its systems. 

The stolen data “generally included ancestry information, and, for a subset of those accounts, health-related information based upon the user’s genetics.” Most people have had their “profile information” and “certain information” stolen, the company said, in a previous, equally vague announcement.

Previous media reports said the database included origin estimation, phenotype and health information, photos and identification data, raw data, and some other account information.

The dark web leak reportedly contained one million lines of data for Ashkenazi people (via Bleeping Computer), also affecting more than 300,000 users of Chinese descent (via The Record).

Via TechCrunch

More from TechRadar Pro

Sign up to read this article
Read news from 100’s of titles, curated specifically for you.
Already a member? Sign in here
Related Stories
Top stories on inkl right now
One subscription that gives you access to news from hundreds of sites
Already a member? Sign in here
Our Picks
Fourteen days free
Download the app
One app. One membership.
100+ trusted global sources.