23andMe tells victims it's their fault that their data was breached(techcrunch.com)
techcrunch.com
23andMe tells victims it's their fault that their data was breached
https://techcrunch.com/2024/01/03/23andme-tells-victims-its-their-fault-that-their-data-was-breached/
368 comments
To be honest it's amazing they are still in business.
The company was originally founded on unreasonable goals in the health industry, using DNA array testing to identify risky variants in individuals to help produce better treatments.
It took the CEO about a decade to learn enough to acknowledge that their approach would never have achieved this, because the mapping from genome to risk/treatment is a highly complex function and their mechanism was underpowered and they also repeatedly pissed off and ignored the FDA who then shut them down for a while. The only reason they survived this was, afaict, the CEO's ability to extract money from google to keep operating.
Eventually, the company found that they could do identity by descent really well, much more useful to customers than telling them their earwax properties, and their "recreational genomics" products were extremely popular- enough to sustain a service, but not really enough to sustain advanced research.
They finally got some pharma to give them a bunch of money for their data (basically all the genomic and phenotype data that they collected on their users) ostensibly to do translational health research, but this has not been very productive (and seems unlikely to be truly transformative).
In the meantime they have to keep runing their consumer platform and it clearly had security issues that permitted a large scale data extraction (that's on them, not the customers) and I jusrt can't see how they keep getting money to operate, because their track record in translating data to profit/medicine has been so skimpy.
The company was originally founded on unreasonable goals in the health industry, using DNA array testing to identify risky variants in individuals to help produce better treatments.
It took the CEO about a decade to learn enough to acknowledge that their approach would never have achieved this, because the mapping from genome to risk/treatment is a highly complex function and their mechanism was underpowered and they also repeatedly pissed off and ignored the FDA who then shut them down for a while. The only reason they survived this was, afaict, the CEO's ability to extract money from google to keep operating.
Eventually, the company found that they could do identity by descent really well, much more useful to customers than telling them their earwax properties, and their "recreational genomics" products were extremely popular- enough to sustain a service, but not really enough to sustain advanced research.
They finally got some pharma to give them a bunch of money for their data (basically all the genomic and phenotype data that they collected on their users) ostensibly to do translational health research, but this has not been very productive (and seems unlikely to be truly transformative).
In the meantime they have to keep runing their consumer platform and it clearly had security issues that permitted a large scale data extraction (that's on them, not the customers) and I jusrt can't see how they keep getting money to operate, because their track record in translating data to profit/medicine has been so skimpy.
On one hand, I have to somewhat agree with 23andMe here. If someone uses the password "password1" for some service, they should not be able to turn around and blame that service when their account is compromised.
On the other hand, 23andMe should have definitely done much more to reduce the blast radius of this attack. Mandatory 2FA, disallowing known-compromised passwords, geolocation of login IPs, etc.
I guess the question shakes out to: where do we draw the line on personal responsibility vs. service responsibility? Services can't be responsible for 100% of user security. But they also can't be negligent in their own security and mitigations.
On the other hand, 23andMe should have definitely done much more to reduce the blast radius of this attack. Mandatory 2FA, disallowing known-compromised passwords, geolocation of login IPs, etc.
I guess the question shakes out to: where do we draw the line on personal responsibility vs. service responsibility? Services can't be responsible for 100% of user security. But they also can't be negligent in their own security and mitigations.
I think 23AndMe could perhaps have done better in detecting this sooner – "perhaps" because with a sufficiently large botnet that's not so easy to detect quickly and details are not available AFAIK.
But other that that, I ... kind of agree with 23AndMe: users should be primarily responsible for their own accounts. I don't like the "assume all users are blubbering morons and treat them as such" security model, and then blame $corp for treating their users as adults. Again, 23AndMe could have done better, maybe, but I strongly disagree that they're primarily responsible – at best they're partly responsible.
And maybe 23AndMe also could/should have pushed 2FA harder, I don't have an account so don't know how hidden this feature was or not. All I know is that mandatory 2FA is a right pain for me, adds basically no security for me because I just store it in my password manager next to the password. For TOTP it's just an inconvenience, but I really dislike phone-number based 2FA – I've been locked out so many times...
But other that that, I ... kind of agree with 23AndMe: users should be primarily responsible for their own accounts. I don't like the "assume all users are blubbering morons and treat them as such" security model, and then blame $corp for treating their users as adults. Again, 23AndMe could have done better, maybe, but I strongly disagree that they're primarily responsible – at best they're partly responsible.
And maybe 23AndMe also could/should have pushed 2FA harder, I don't have an account so don't know how hidden this feature was or not. All I know is that mandatory 2FA is a right pain for me, adds basically no security for me because I just store it in my password manager next to the password. For TOTP it's just an inconvenience, but I really dislike phone-number based 2FA – I've been locked out so many times...
> Such information would only be available if plaintiffs affirmatively elected to share this information with other users via the DNA Relatives feature.
I'm skeptical that 6.9 M users opted-in to an off-by-default setting. That seems absurdly high for any opt-in feature that involves nebulous user value. I don't use 23andme, but I'd love it if someone had screenshots of this supposed "opt-in" before the data breach.
Also, how far does the sharing go? How far removed from a family member does a user have to be to see their info? Going from 14k to 6.9M seems like it must have been more than just immediate family, given the small family size common today.
I'm skeptical that 6.9 M users opted-in to an off-by-default setting. That seems absurdly high for any opt-in feature that involves nebulous user value. I don't use 23andme, but I'd love it if someone had screenshots of this supposed "opt-in" before the data breach.
Also, how far does the sharing go? How far removed from a family member does a user have to be to see their info? Going from 14k to 6.9M seems like it must have been more than just immediate family, given the small family size common today.
The fact that they immediately enforced MFA after the breach shows they know exactly how culpable they are.
As mentioned in the article, a few mitigations could have been applied to mitigate, though not eliminate. None of these are perfect, nay sayers will pop up lamenting "it wouldnt work" but the point is it would help.
1. Fraud detection on the metadata like IP address, access timing, access patterns etc. eg: Why is a person from UK logging in from China IP?
2. IMO orgs should be importing and refusing known leaked credentials and the top 1000 passwords. This could happen both at password set time ("You cannot use that password as it's a known leaked credential, click here for more info about the breach"), or at login time "You're using a leaked credential, please follow the password reset flow".
1. Fraud detection on the metadata like IP address, access timing, access patterns etc. eg: Why is a person from UK logging in from China IP?
2. IMO orgs should be importing and refusing known leaked credentials and the top 1000 passwords. This could happen both at password set time ("You cannot use that password as it's a known leaked credential, click here for more info about the breach"), or at login time "You're using a leaked credential, please follow the password reset flow".
Remember that when you are giving your DNA to a company, you are also partly doing it for all your family members. Maybe talk about it with them before doing it, especially if it is just for fun.
So I'm a user of 23andMe. I have DNA relatives on (dont find it that useful though), but I don't really see much "DNA" in terms of "my relatives" (I've also never accepted anyone to see any of my profile, I just see who they say are relatives and how close they are (first/second/third cousin and so forth).
I assume most people are the same.
Therefore, I'm not sure what significant information an attacker could have gotten on me. Anyone care to enlighten me?
I assume most people are the same.
Therefore, I'm not sure what significant information an attacker could have gotten on me. Anyone care to enlighten me?
It's all a balancing act between not wanting to unduly impact legitimate customers, while blocking as much fraud as possible.
Blocking the credential stuffing attacks? They probably did have mitigation efforts, but you can only be so aggressive before the false positives start blocking significant numbers of legitimate customers, who have no recourse except to wait out a temporary ban. And some credential stuffing attacks are extremely sophisticated, such that even best in class security companies can't always effectively block them.
Mandatory MFA? Great on paper, except that 10% of people hate the extra steps (probably with great overlap between the people reusing passwords) and will complain and/or disable it if given the chance. Another 20% have invalid or out of date contact details (an old employer's email address, a landline phone number that can't receive SMS, etc.), and they'll be locked out of their accounts.
Yeah, there are ways to mitigate these downsides. And I'm not arguing that 23andme found the appropriate balance between "customer satisfaction" and "customer security." But I can see how a mostly reasonable organization could end up in this position. And it's mainly the risk of terrible press and upset customers that allows other companies to justify more security-oriented policies, so let them have it.
Blocking the credential stuffing attacks? They probably did have mitigation efforts, but you can only be so aggressive before the false positives start blocking significant numbers of legitimate customers, who have no recourse except to wait out a temporary ban. And some credential stuffing attacks are extremely sophisticated, such that even best in class security companies can't always effectively block them.
Mandatory MFA? Great on paper, except that 10% of people hate the extra steps (probably with great overlap between the people reusing passwords) and will complain and/or disable it if given the chance. Another 20% have invalid or out of date contact details (an old employer's email address, a landline phone number that can't receive SMS, etc.), and they'll be locked out of their accounts.
Yeah, there are ways to mitigate these downsides. And I'm not arguing that 23andme found the appropriate balance between "customer satisfaction" and "customer security." But I can see how a mostly reasonable organization could end up in this position. And it's mainly the risk of terrible press and upset customers that allows other companies to justify more security-oriented policies, so let them have it.
They prioritized earning new business and lowering customer friction over enforcing MFA. They also had no idea 14k accounts were brute forced and cred stuffed, so that's 100% on them. They have enough money to do the security work.
Its not like they dont already provide this to police and governments without a warrant and sell the data. If you expected your most personal data to be secure with them you havent been paying attention.
It's not clear to me, due to the particular nature of the data in this breach and why it was available to the 14 000 compromised accounts, that it getting breached will actually cause any damages.
This is data that appears in the ancestry data for the 14 000 compromised accounts. Your data only appears in another account's ancestry data if you opted in to sharing ancestry data and they are a relative of yours. I think most people opt in, because (1) finding out about your ancestry and relatives is one of the main reasons people use services like 23andMe, and (2) even people who started using it just for the health data often get curious and start using the ancestry stuff too.
23andMe counts anyone who is a 4th cousin or closer as a relative, which results in some big relative lists. Mine has 1500 other 23andMe users in it, but that might be above average. Based on 23andMe having 14 million customers, 14 000 accounts being compromised, and 6.9 million accounts having data taken via the relatives lists of those 14 000 compromised accounts, and assuming that everything that I don't have any data on is is pretty evenly distributed (the statistical equivalent of a spherical cow) I'd guess that the average is around 700.
If that's even in the right ballpark then when you opt in to sharing this data you are opting in to share it with several hundred people, mostly complete strangers to you, mostly scattered all over the US and a few foreign countries.
At that point I'm not sure if the different between just sharing it with them and sharing it with the world is meaningful.
This is data that appears in the ancestry data for the 14 000 compromised accounts. Your data only appears in another account's ancestry data if you opted in to sharing ancestry data and they are a relative of yours. I think most people opt in, because (1) finding out about your ancestry and relatives is one of the main reasons people use services like 23andMe, and (2) even people who started using it just for the health data often get curious and start using the ancestry stuff too.
23andMe counts anyone who is a 4th cousin or closer as a relative, which results in some big relative lists. Mine has 1500 other 23andMe users in it, but that might be above average. Based on 23andMe having 14 million customers, 14 000 accounts being compromised, and 6.9 million accounts having data taken via the relatives lists of those 14 000 compromised accounts, and assuming that everything that I don't have any data on is is pretty evenly distributed (the statistical equivalent of a spherical cow) I'd guess that the average is around 700.
If that's even in the right ballpark then when you opt in to sharing this data you are opting in to share it with several hundred people, mostly complete strangers to you, mostly scattered all over the US and a few foreign countries.
At that point I'm not sure if the different between just sharing it with them and sharing it with the world is meaningful.
if it was truly a credential stuffing attack, then there's a shared responsibility between users and 23andme. 23andme is responsible for not enabling 2FA. the users are responsible for reusing passwords.
to me, the takeaway is that we need to roll out passkeys as quickly as possible.
to me, the takeaway is that we need to roll out passkeys as quickly as possible.
[deleted]
> users negligently recycled and failed to update their passwords following these past security incidents, which are unrelated to 23andMe. Therefore, the incident was not a result of 23andMe’s alleged failure to maintain reasonable security measures.
23andMe's argument seems ridiculous on its face.
23andMe's argument seems ridiculous on its face.
>“ 23andMe knew or should have known that many consumers use recycled passwords ”
How would they know this?
How would they know this?
On the one hand, I sympathize with anyone whose data is stolen in a data breach, we've all been there (and some of us have three dollars from Equifax lining our pockets to prove it).
On the other hand, I remember thinking ten years ago or whatever: "23AndMe sounds cool, I'd love to know about my ancestry and genetic risk factors, but that's a crazy amount of intensely personal data to trust a corporation with, so I guess I won't do that." And I'm as dumb as a rock, so if I made that decision with the same information as everyone else, it must have been pretty obvious what the consequences could be.
On the other hand, I remember thinking ten years ago or whatever: "23AndMe sounds cool, I'd love to know about my ancestry and genetic risk factors, but that's a crazy amount of intensely personal data to trust a corporation with, so I guess I won't do that." And I'm as dumb as a rock, so if I made that decision with the same information as everyone else, it must have been pretty obvious what the consequences could be.
Is there a geneology service that does not store your data?
Any kind of storage is a non-starter.
Any kind of storage is a non-starter.
6.9 million accounts had information stolen because they were "relatives" of 14,000 users? Something doesn't add up there. That would mean each of those random users had 492 "relatives" on the platform. I've never used 23andMe for fears of exactly this, but they should look at recalibrating what the term "relative" means if you're opting in to sharing genetic information. The average Facebook user has 338 friends, as a point of reference, and I sure wouldn't want my information shared with those people.
23andMe, Ancestry.com, and similar sites have extreme appeal to some of the oldest and least technical users. It's grandmas and grandpas who are willing to pay $20/month for a DNA site. The Venn diagram of DNA site users and online/telephone scam victims has to have a big overlap.
This is a tough population to increase the security for. They are highly vulnerable to social engineering, reuse passwords, use weak passwords, and struggle mightily with 2FA or other methods. But that's the gig, it's on 23andMe to solve it.
This is a tough population to increase the security for. They are highly vulnerable to social engineering, reuse passwords, use weak passwords, and struggle mightily with 2FA or other methods. But that's the gig, it's on 23andMe to solve it.
You always know you’re in a strong position when you have to resort to “stop hitting yourself” or “don’t make me hurt you, I don’t like it when you make me hurt you”.
According to this filing, as of 29 Dec 2023, there are 35 cases filed against 23andMe so far based on this incident.
https://ia904506.us.archive.org/10/items/gov.uscourts.cand.3...
Almost all of them are in N.D. Cal but there is one filed in N.D. Ill. and one in C.D. Cal.
https://ia904506.us.archive.org/10/items/gov.uscourts.cand.3...
Almost all of them are in N.D. Cal but there is one filed in N.D. Ill. and one in C.D. Cal.
> “Therefore, the incident was not a result of 23andMe’s alleged failure to maintain reasonable security measures”
In all honesty, you can hardly make this claim unless they properly communicated and mandated (at least in writing, since I can't imagine how it could be actually enforced) that users chose/pick passwords different from other platforms. Or at the least enforce an aggressive password change schedule, etc...
In all honesty, you can hardly make this claim unless they properly communicated and mandated (at least in writing, since I can't imagine how it could be actually enforced) that users chose/pick passwords different from other platforms. Or at the least enforce an aggressive password change schedule, etc...
23andMe is such a bizarre service to me. I have absolutely no desire to find out the details of some long lost cousin I don’t know, or know there is a chance I’m 2% Viking. Or have the chance to develop some weird kind of cancer because some post doc working in a papermill published a paper.
I would have never guessed people would be interested in such useless information.
I would have never guessed people would be interested in such useless information.
Here is the thing: unless the attackers got into these accounts by guessing weak passwords at the login page, 23andMe are at fault.
The data breach by which attackers get their hands on passwords isn't the fault of the users.
Only the consequence of that breach to some of the users is their own fault.
The data breach by which attackers get their hands on passwords isn't the fault of the users.
Only the consequence of that breach to some of the users is their own fault.
If we're going to blame the victims, at least do it right - the mistake was submitting sensitive information to a gross, sketchy outfit like 23andMe.
Much like Uber, self-enshitification was obviously the "???" part of the underpants gnomes' plans.
Much like Uber, self-enshitification was obviously the "???" part of the underpants gnomes' plans.
Is there anywhere to get a DNA test anonymously? I assume maybe you could put false information into 23andMe, but I assume they'd still have your name from your credit card.
So from now on does everyone here check each login from any user against known vulnerable password lists or known leaks? As new compromises might appear after password has been set or changed...
More likely this will prove to be another example of individuals under appreciating their personal data and privacy, and over appreciated some kind of novel technology.
23andMe then claims that poor password practices are responsible for this data leak.
> “Therefore, the incident was not a result of 23andMe’s alleged failure to maintain reasonable security measures”
I've not run security at an org of their size, nor have i touched their service, but i have to imagine there were some patterns to this breach that would have been reasonable to account for ahead of time. Did those 14k accounts also have their email provider accounts compromised? Could a login ip-range check have prevented all of this? 2FA seems like an obvious answer here but clearly that was more than could be expected.