23andMe, a genetic testing company has acknowledged a massive cyber attack that led to hackers stealing, publishing, and selling data about 1 million people, Verge reported. The data breach was revealed after hackers published a database titled “Ashkenazi DNA Data of Celebrities” on dark web forums. The database includes information such as display names, sex, birth year, and some details about users' genetic ancestry results.
Notably, 23andMe is a US biotechnology and genomics firm offering genetic testing services to customers who send a saliva sample to its labs and get back an ancestry and genetic predispositions report.
''On offer are DNA profiles of millions, ranging from the world's top business magnates to dynasties often whispered about in conspiracy theories. Each set of data also comes with corresponding email addresses," one of the posts on the data-selling forum reads.
The hacker also claimed to have data from celebrities, such as Mark Zuckerberg and Elon Musk, but this has not been verified by 23andMe.
The hacker has offered to sell data profiles in bulk for $1 to $10 per account. Meanwhile, PCMag reported that as many as 7 million accounts may be in the sale.
''The main value from this hack is going to be personal information that might be used in scams later. Names, addresses, telephone numbers, general personal information – hackers tend to sell this to scammers, who can then write spam emails that are more targeted. It's 'Dear Alan' rather than 'Dear valued customer', so you think they know who you are and that it must be legitimate'' Professor Alan Woodward, a cyber security specialist based at the University of Surrey told the Metro.
23andMe is treating the leak as authentic and investigating the incident. Talking about the breach, 23andMe managing editor Scott Hadly said ''the preliminary results of this investigation suggest that the login credentials used in these access attempts may have been gathered by a threat actor from data leaked during incidents involving other online platforms where users have recycled login credentials.'' He added that there was no indication of ''a security incident within our systems.''
''We are taking this issue seriously and will continue our investigation to confirm these preliminary results,'' 23andMe said in a statement.
''Out of caution, we are requiring that all customers reset their passwords and are encouraging the use of multi-factor authentication (MFA). If we learn that a customer's data has been accessed without their authorization, we will notify them directly with more information,'' the statement added.
‘.
