DNA testing firm 23andMe has argued the victims are responsible for the breach of highly sensitive genomics data on its systems last year.
The DNA testing firm argued this allowed the attackers to launch a credential stuffing campaign using usernames and passwords accessed in separate breaches.
In the incident, which took place in October 2023, nearly 7 million customers' information was accessed, including a significant number of files containing information about some users' genealogy, such as ethnicity and ancestry.
The hackers initially accessed around 14,000 user accounts via the credential stuffing campaign.
They then used this information to access the personal data of 6.9 million users who had opted into 23andMe's DNA Relatives feature, in which customers automatically share some of their data with people who are considered their relatives on the platform.
23andMe claimed in the letter that there was also no case as the victims had elected to share their information with other users by opting into the DNA Relatives feature.
In the lawsuit filing, Bacus v 23andMe, Inc., the plaintiff alleges the DNA testing firm did not take reasonable measures to secure user accounts, which resulted in the breach.
Since the incident, 23andMe confirmed it has added new security measures to protect user accounts.
This includes ending all active logged-in user accounts, requiring a password reset on all user accounts and requiring all customers to use two factor authentication.
Industry experts quickly criticized 23andMe's assertion that the victims were to blame for the breach.
Erfan Shadabi, Cybersecurity Expert at comforte AG, commented that while users do have an obligation to follow best practices in areas like password management, companies also have a duty to protect the sensitive information that has been entrusted to them, such as enforcing 2FA policies.
Nick Rago, Field CTO at Salt Security, said that 23andMe's argument that the breach cannot cause financial harm because it did not include information like credit card details is completely outdated.
He noted that exposing any genealogy or relationship information would be highly useful to an attacker in developing a targeted social engineering campaign to scam a consumer, steal an identity or gain privileged system access in a corporate infrastructure.
Examples of recent breaches that were rooted with a successful targeted social engineering campaign include those that affected JumpCloud, MGM and Caesars.
This Cyber News was published on www.infosecurity-magazine.com. Publication date: Fri, 05 Jan 2024 10:45:22 +0000