23andMe says hackers accessed ‘significant number’ of data about people’ ancestry

Genetic evaluation organization 23andMe announced on Friday that hackers accessed around 14,000 buyer reports within the company’s current information breach.

In a new filing with the U.S. Securities and Exchange Commission posted Friday, the business stated that, predicated on its examination in to the event, it had determined that hackers had accessed 0.1percent of the customers. According to the company’s most recent annual earnings report, 23andMe features “more than 14 million consumers globally,” which means that 0.1% is just about 14,000.

But the business additionally stated that by opening those reports, the hackers had been additionally in a position to access “a large number of data profile that is containing about other users’ ancestry that such users chose to share when opting in to 23andMe’s DNA Relatives feature.”

The company did not specify what that number that is“significant of data is, nor what number of of those “other people” had been influenced.

23andMe Did not immediately respond to a request for comment, which included questions on those true numbers.

In early October, 23andMe disclosed an incident in which hackers had stolen some users’ data using a technique that is common as “credential stuffing,” whereby cybercriminals hack into a victim’s account making use of a known password, possibly leaked because of a data breach on another solution.

The harm, nonetheless, didn’t end using the consumers who’d their accounts accessed. 23andMe allows people to choose into an attribute called DNA Relatives. Some of that user’s information with others if a user opts-in to that feature, 23andMe shares. That means that by accessing one victim’s account, hackers were also able to see the personal data of people connected to that victim that is initial

23andMe said within the filing that when it comes to preliminary 14,000 people, the taken information “generally included ancestry information, and, for a subset of these reports, health-related information in relation to the user’s genetics.” 23andMe only said that the hackers stole “profile information” and then posted unspecified “certain information” online.

For for the other subset of users Millionaires analyzed the published sets of stolen data by comparing it to known genealogy that is public, including internet sites posted by hobbyists and genealogists. Even though the units of information had been formatted differently, they included a few of the exact same user that is unique genetic information that matched genealogy records published online years earlier.

The owner of one genealogy website, for which some of their relatives’ information was exposed in 23andMe’s data breach, told For Millionaires that they have about 5,000 relatives discovered through 23andMe, and said our “correlations might take that into account.”surfaced onlineNews of the data breach

in October when hackers advertised the alleged data of one million users of Jewish Ashkenazi descent, and 100,000 Chinese users on a well-known forum that is hacking. About fourteen days later on, the hacker that is same advertised the initial stolen user data advertised the alleged records of four million more people. The hacker was trying to sell the data of individual victims for $1 to $10.

For Millionaires found that another hacker on a hacking that is different had promoted a lot more allegedly stolen individual data 2 months ahead of the ad that has been at first reported by development outlets in October. The hacker claimed to have 300 terabytes of stolen 23andMe user data, and asked for $50 million to sell the whole database, or between $1,000 and $10,000 for a subset of the data.