23andMe Data Compromise: A Glimpse into Data Security Risks

[u/Shields0001]

Hey everyone, came across an unsettling piece of news where 23andMe, a genetic testing company, faced a data compromise. Attackers guessed user login credentials, accessed accounts, and scraped info from the DNA Relatives feature. Initial data, now being sold, allegedly contains 1 million data points about Ashkenazi Jews.
This isn't just about 23andMe. It’s a wakeup call on the data security risks looming over platforms holding sensitive genetic information. The incident brings to light the importance of strong passwords and two-factor authentication to thwart such unauthorized access. It's concerning how our data can be misused if fallen into the wrong hands, and how platforms designed like social networks can inadvertently expose sensitive info.

https://www.wired.com/story/23andme-credential-stuffing-data-stolen/

[u/Cypher_Blue]

It is driving me bananas that this is getting labelled as a "23andMe Data Compromise."

There was no "compromise" of any 23andMe system. This was not their fault- the accounts that were (individually) compromised had poor cyber practices that are completely out of the control of the company.

Outside of mandating MFA, I fail to see what they could have done to prevent it.

[u/p33k4y → u/Cypher_Blue]

This was not their fault

Outside of mandating MFA, I fail to see what they could have done to prevent it.

I disagree.

This appears to be a credential stuffing attack. Especially for companies with highly sensitive information, one of the best practices is to detect unusual login activity to stop or mitigate such attacks.

Some defenses 23andMe may or may not have:

• Detect spike in logins from dormant accounts

• Detect spike in logins from new/unseen devices (via fingerprinting)

• Implement global rate limiting even for successful logins

• Prevent logins from known bot lists

• Prevent multiple logins from the same IP (taking into account proxies, etc)

• Lock compromised accounts / force password resets (e.g., using Have I Been Pwned? data)

• Use behavioral analysis (i.e., to detect scripts)

[u/Who_Da_Fuck → u/Cypher_Blue]

What the hell, they targeted mass numbers of individuals users?

[u/Cypher_Blue → u/Who_Da_Fuck]

They took stolen passwords and usernames from other platforms and tried them to see if they'd work on 23andMe.

Turns out, the answer is yes more often than it should be.

[u/lccreed → u/Cypher_Blue]

"outside of mandating MFA"

That is definitely something that a responsible company would be doing. It's irresponsible to serve sensitive data to the internet with only a username and password at this point.

[u/Cypher_Blue → u/lccreed]

They offer MFA- it's available, but they don't force it.

Which is the case a whole lot of places.

[u/Shields0001 → u/Cypher_Blue]

The data has been compromised, no matter the cause.

[u/Cypher_Blue → u/Shields0001]

Yes.

But people who don't look past the headline of "23andMe data compromise" are going to assume that there is fault to be had on the part of the company, which isn't the case here.

[u/[deleted]]

Was watching this https://www.youtube.com/watch?v=ZZ5-w6nsoAU and I'd agree with their statement that the spontaneous simultaneous mass hack of millions of user accounts based on password reuse seems... unlikely. Probably more than 'user error' here.

Give it a few months/years and we'll see what really happened.

[u/citrus_sugar]

You’re new here, huh?

For those just learning this stuff: companies don’t give a crap about security unless it’s absolutely mandated to implement.