23andMe user data breached in credential-stuffing attack
A run-of-the-mill attack was made worse by an internal user feature.
Biotech company 23andMe, known for its DNA testing kits, confirmed to BleepingComputer that its user data is circulating on hacker forums. The company said the leak occurred through a credential-stuffing attack.
A credential-stuffing attack involves user information that has already been compromised (usernames and passwords, for example) from one organization, which a hacker obtains and attempts to reuse with a second organization — in this case, 23andMe. Because of the nature of credential-stuffing, it does not appear this was a breach of the company's internal systems. Rather, accounts were broken into piecemeal. The perpetrators of this attack appear to have obtained quite sensitive information from the compromised accounts (photos, full names and geographical location, among other things). "Thus far, our investigation has found that no genetic testing results have been leaked," a 23andMe spokesperson said in an email. In an official public statement, the company said that after becoming aware of suspicious activity, it immediately began an investigation.
The initial leak comprised “1 million lines of data for Ashkenazi people,” according to BleepingComputer. By October 4, data was being offered for sale in bulk, in increments of 100, 1,000, 10,000 or 100,000 profiles. The scale of the attack is as yet unknown, but the scope of its impact has likely been exacerbated by 23andMe's 'DNA Relatives' feature. "Relatives are identified by comparing your DNA with the DNA of other 23andMe members who are participating in the DNA Relatives feature," the company states. After accessing an unknown number of profiles via credential-stuffing, the threat actor behind this breach apparently scraped the 'DNA Relatives' results for those profiles, netting much more sensitive data. According to the same FAQ page, "The number of relatives listed [..] grows over time as more people join 23andMe." For the fiscal year 2023, the company reported it “genotyped” around 14 million customers.
Ever since 23andMe went public in 2021, the company has faced extra scrutiny for its data protection practices — rightly so, since it deals with sensitive medical data derived from saliva sampling, including predispositions for diseases like Alzheimer's, Type 2 diabetes and even cancer. On its website, the company claims it "exceeds" data protection standards for its industry.
Update, October 7 2023, 3:15 PM ET: This story has been updated to correct a statement about the type of sensitive information that was compromised in the leak. The company said that so far, no genetic testing results have been leaked.
