Nearly 7 million 23andMe customers had their profile data leaked in a cybersecurity incident in October, a company spokesperson confirmed to SC Media on Monday.
The vast majority of the leaked data was scraped from the site's DNA Relatives feature after hackers used stolen credentials to directly access about 14,000 accounts, which represents 0.1% of users.
Details of the cyber incident come on the heels of a Friday filing by 23andMe with the U.S. Securities and Exchange Commission amending a previous 8-K disclosure.
A 23andMe said that 5.5 million users had their DNA Relatives profiles leaked, with an additional 1.4 million users having their Family Tree profiles exposed.
23andMe's DNA Relatives feature enables users to see profile information of other users they are genetically related to.
Family Tree profiles are a part of the DNA Relatives feature that contains a limited subset of data.
In total, approximately 6.9 million customers using the DNA Relatives feature had some information leaked, 23andMe said.
Threat actors initially accessed 14,000 accounts out of 23andMe's 14 million customers.
By using stolen credentials from other third-party websites adversaries were able to log in to 23andMe customer accounts.
The attackers then leveraged accounts to scrape information shared by users who opted into the service's DNA Relatives feature.
This allowed hackers to expand the scope of data scraped from 23andMe.
Each compromised account, according to the company, could potentially have access to data from hundreds or thousands more users.
A review of a standard 23andMe account by SC Media revealed a customer had access to 1,500 DNA relatives.
Golem allegedly leaked information from more than 1 million Ashkenazi Jewish users and 300,000 Chinese users on Oct. 1, followed by data from an additional 4.1 million profiles of British and German customers on Oct. 17.
Golem claimed to have access to data from more than 7 million users in total.
Sensitive health data leaked in the incident includes a user's predisposition to type 2 diabetes and Parkinson's disease.
Reports also include a user's gene carrier status for cystic fibrosis, Tay-Sachs disease and others.
23andMe says it has temporarily disabled some features within the DNA Relatives tool in response to the leak and said in its amended SEC report that it is working to remove all leaked information from public access.
The company also forced all users to reset their password and encouraged them to use multi-factor authentication on Oct. 9.
23andMe says the unauthorized access to its platform was due to credential stuffing attacks where hackers used stolen credentials from unrelated third-party sites.
This Cyber News was published on packetstormsecurity.com. Publication date: Tue, 05 Dec 2023 14:43:06 +0000