23andMe Hack Breaches 6.9 Million Customers’ Data, Together with Some’s Well being Knowledge

Some 6.9 million 23andMe clients had their information compromised after an nameless hacker accessed person profiles and posted them on the market on the web earlier this yr, the corporate mentioned on Monday. 

The compromised information included customers’ ancestry data in addition to, for some customers, health-related data primarily based on their genetic profiles, the corporate mentioned in an e mail. 

Privateness advocates have lengthy warned that sharing DNA with testing corporations like 23andMe and Ancestry makes shoppers susceptible to the publicity of delicate genetic data that may reveal well being dangers of people and people who are associated to them.

Learn Extra: DNA Testing Kits Are on Everybody’s Vacation Record. 5 Issues to Know If You Get One

Within the case of the 23andMe breach, the hacker solely immediately accessed about 14,000 of 23andMe’s 14 million clients, or 0.1%. However on 23andMe, many customers select to share data with individuals they’re genetically associated to — which might embody distant cousins they’ve by no means met, along with direct members of the family — as a way to be taught extra about their very own genetics and construct out their household timber. So by means of these 14,000 accounts, the hacker was in a position to entry details about hundreds of thousands extra. A a lot smaller subset of consumers had well being information accessed.

Customers can select whether or not to share completely different varieties of information, together with title, location, ancestry and well being data comparable to genetic predisposition to situations comparable to bronchial asthma, anxiousness, high-blood stress and macular degeneration. 

The publicity of such data might have regarding ramifications. Within the U.S., well being data is often protected by what’s referred to as the Well being Insurance coverage Portability and Accountability Act, or HIPAA. However such protections solely apply to health-care suppliers.

The 2008 Genetic Info Nondiscrimination Act (GINA), protects towards discrimination in employment and medical health insurance ought to data from a DNA check make it out into the wild. This goals to guard people from being denied a job or insurance coverage protection if, for instance, a DNA check reveals they’re prone to finally creating a debilitating situation.

However the legislation has loopholes; each life insurers and incapacity insurers, for instance, are free to disclaim individuals insurance policies primarily based on their genetic data. 

There have been different high-profile hacks of DNA testing corporations. However 23andMe is the primary breach of a significant firm during which the publicity of well being data was publicly disclosed. (The Federal Commerce Fee lately ordered a smaller agency, Vitagene, to strengthen protections after well being data was uncovered.)

The hacker appeared to make use of what’s referred to as credential stuffing to entry buyer accounts, logging into particular person 23andMe accounts by utilizing passwords that had been recycled and used for different web sites that had been beforehand hacked. The corporate mentioned there was no proof of a breach inside its personal techniques. 

For the reason that hack, the corporate introduced that it’ll require two-factor authentication as a way to shield towards credential-stuffing assaults on the location. It has mentioned it expects to incur $1 million to $2 million in prices associated to the breach.