Genetic testing company 23andMe declared on Friday that approximately 14,000 customer accounts were compromised in its recent data breach. In an updated submission to the U.S. Securities and Exchange Commission, the company revealed that its investigation determined the breach affected 0.1% of its customer base, equivalent to around 14,000 individuals out of its reported 14 million worldwide customers.
The hackers not only gained access to these accounts but also managed to retrieve "a significant number of files" containing profile information related to other users' ancestry who had opted into 23andMe's DNA Relatives feature. The company refrained from specifying the exact number of impacted files or users in this category.
Despite requests for clarification on these figures, 23andMe did not immediately respond to inquiries. The data breach, disclosed in early October, utilized the "credential stuffing" method, where hackers exploit a known password obtained from a previous data breach to infiltrate a victim's account.
The repercussions extended beyond the initially compromised accounts due to 23andMe's DNA Relatives feature, allowing hackers to access personal data of individuals connected to the primary victim. The stolen data for the initial 14,000 users generally included ancestry information and, for a subset, health-related information based on genetics. For the other subset, 23andMe mentioned the theft of "profile information" without specifying the details.
Upon analyzing the stolen data, TechCrunch found similarities with known public genealogy records, raising concerns about the exposure of sensitive user and genetic information.
The data breach first surfaced in October when hackers advertised alleged data from one million Jewish Ashkenazi descent users and 100,000 Chinese users on a prominent hacking forum. Subsequently, the same hacker offered records of an additional four million people for sale.
A separate hacker, reported two months earlier, claimed to possess 300 terabytes of stolen 23andMe user data, seeking $50 million for the entire database or offering subsets for amounts ranging from $1,000 to $10,000. In response to the breach, 23andMe enforced password resets on October 10 and urged users to enable multi-factor authentication. By November 6, the company mandated two-step verification for all users. Following 23andMe's breach, DNA testing companies Ancestry and MyHeritage also implemented mandatory two-factor authentication.