News: Hacker stole data of 6.9 million 23andMe customers and then put it up for sale online

[Arcadia]

https://fortune.com/2023/12/04/23andme-customer-health-data-hacking/

"Some 6.9 million 23andMe customers had their data compromised after an anonymous hacker accessed user profiles and posted them for sale on the internet earlier this year, the company said on Monday. The compromised data included user ancestry data as well as, for some users, health-related information based on their genetic profiles.

... Since the hack, the company announced that it will require two-factor authentication in order to protect against credential-stuffing attacks on the site. "

[Pam in CT]

Huh.

Well, any government that *had been* limited by pesky privacy/ due process/ inconvenient warrant requirements before the breach has had plenty of time to just BUY the information up by now.  If so inclined.

[TechWife]

26 minutes ago, Pam in CT said:

Huh.

Well, any government that *had been* limited by pesky privacy/ due process/ inconvenient warrant requirements before the breach has had plenty of time to just BUY the information up by now.  If so inclined.

Insurance companies that offer life and/or individual medical insurance provide another  market, too. 

[PeterPan]

https://techcrunch.com/2023/12/04/23andme-confirms-hackers-stole-ancestry-data-on-6-9-million-users/

This article seems a little more helpful as to what technically happened.

[Halftime Hope]

2 hours ago, PeterPan said:

https://techcrunch.com/2023/12/04/23andme-confirms-hackers-stole-ancestry-data-on-6-9-million-users/

This article seems a little more helpful as to what technically happened.

"Considering the new numbers, in reality, the data breach is known to affect roughly half of 23andMe’s total reported 14 million customers."

[PinkTulip]

This just confirms why I will never do this type of testing. 

[TexasProud]

13 hours ago, PinkTulip said:

This just confirms why I will never do this type of testing. 

Yeah, but none of your medical data is really safe anyway.  This happened nearby:
https://www.scmagazine.com/news/thanksgiving-week-ransomware-attack-hits-ardent-health-hospitals-in-6-states

Our hospital had to divert patients from Thanksgiving until today.  Not sure about the other locations.

Edited December 5, 2023 by TexasProud

[Arcadia]

59 minutes ago, TexasProud said:

Yeah, but none of your medical data is really safe anyway. 

I agree. Blue Cross Blue Shield was hacked again a few days ago. They have been hacked quite a few times.

[AnotherNewName]

On 12/4/2023 at 6:54 PM, TechWife said:

Insurance companies that offer life and/or individual medical insurance provide another  market, too. 

Insurance companies which provide medical insurance are prohibited by federal law from using genetic testing to set rates or determine coverage.

The Genetic Information Nondiscrimination Act of 2008 | U.S. Equal Employment Opportunity Commission (eeoc.gov)

[TexasProud]

1 hour ago, AnotherNewName said:

Insurance companies which provide medical insurance are prohibited by federal law from using genetic testing to set rates or determine coverage.

The Genetic Information Nondiscrimination Act of 2008 | U.S. Equal Employment Opportunity Commission (eeoc.gov)

🤣🤣🤣 I am sure they follow that.

It would be very hard to prove if they did that. 

[AnotherNewName]

On 12/6/2023 at 7:17 AM, TexasProud said:

🤣🤣🤣 I am sure they follow that.

It would be very hard to prove if they did that. 

Why would a highly regulated, multi-billion dollar industry risk its profits on data acquired illegally that doesn't necessarily give them a significant benefit?  

[amyx4]

I'm not an IT personal at all but there's an IT person in my social circle.

My limited understanding is that most companies are paying the ransom to keep their data from become public. The nearest community college, medium size city and a police station have all paid the ransom. 

I don't understand why 23andMe didn't negotiate with the hackers? The company absolutely had to have know that personal information would be released if they didn't work something out.

Edited December 10, 2023 by amyx4