Biotech and DNA-collection biz 23andMe, the one that blamed its own customers for the October mega-breach, just admitted it failed to detect any malicious activity for the entire five months attackers were breaking into user accounts.
In a collection of data breach notifications filed with California's attorney general Rob Bonta, 23andMe revealed attackers were using credential stuffing techniques between April 29 and September 27, 2023.
It also said the malicious activity was only detected in October after seeing a Reddit post related to the sale of the data, rather than interal security tooling picking up on the mess.
It's not clear how many accounts were targeted over that five-month period, but the company previously said that 14,000 accounts were broken into, accounts that had the DNA Relatives feature enabled which ultimately exposed the data of 6.9 million individuals.
DNA Relatives is a core feature of the 23andMe service that allows users to find individuals they may be related to, based on how strong the DNA match is between them.
If an account was compromised through credential stuffing, the data shared by those with even a minuscule percentage of shared DNA could have been scooped up by the attacker.
23andMe's breach notifications laid out the type of data that could have been stolen.
Basic profile information that was likely to have been exfiltrated in the event of a compromise included last login data, relationship labels, predicted relationships such as great aunt, percentage of DNA shared, and the account display name.
Display names are configurable on 23andMe, with a range of options available from full names to just the first initial of each name.
Optionally, users can also choose to share additional information with those who share their DNA, including ancestry reports, matching DNA segments, location, ancestor birth locations, family names, profile picture, birth year, family trees, and personal bios.
Credential stuffing attacks can in some cases be difficult for organizations to detect given the compromised accounts were accessed using the proper credentials, though there are various controls that can be implemented to help spot malicious activity.
Endpoint solutions can pick up on single sources trying to log into accounts en masse, for example, and that IP address can then be blocked, preventing further intrusion attempts.
The main way to stop credential stuffing in its tracks is to just enable two-factor or multi-factor authentication, as has been the advice of the industry for god knows how long now.
23andMe only started mandating 2FA by default in November, a month after it detected the breach.
In letters sent to lawyers representing 23andMe breach victims, the biotech firm said the breach was caused by user negligence, denying all allegations that its alleged security failures were instead the leading cause.
Infosec experts divided over 23andMe's 'victim-blaming' stance on data breach 23andMe responds to breach with new suit-limiting user terms Cybercrim claims fresh 23andMe batch takes leaked records to 5 million DNAaaahahaha: Twins' 23andMe, Ancestry, etc genetic tests vary wildly, surprising no one.
Others sided with the company, saying the users were indeed at fault for not changing their login credentials after they were compromised in a previous breach - a breach about which they were most likely alerted over email.
This all came after the company tried to limit victims' ability to launch legal action by changing its terms of service.
It controversially introduced a new 60-day dispute resolution period that stipulated aggrieved customers must first attempt to resolve a dispute informally before pursuing their legal options.
23andMe did not immediately respond to a request for a statement.
This Cyber News was published on go.theregister.com. Publication date: Fri, 26 Jan 2024 16:13:03 +0000