<story><title>23andMe says user data stolen in credential stuffing attack</title><url>https://www.bleepingcomputer.com/news/security/genetics-firm-23andme-says-user-data-stolen-in-credential-stuffing-attack/</url></story><parent_chain><item><author>codetrotter</author><text>&amp;gt; Why are you letting people log into an account from a brand-new IP with no additional verification?&lt;p&gt;Is that really feasible today? With widespread use of phones and laptops, most people probably have at least a handful of different IP addresses they regularly use (home WiFi, work WiFi, cellular connection) and then they randomly connect from new up addresses like those from libraries, coffee shops, commute, etc&lt;p&gt;I think most “normal” apps and websites today allow any random IP to log in without jumping through extra hoops.&lt;p&gt;Only companies with big budgets (Apple, Google, etc) make regular users jump through extra hoops.&lt;p&gt;Banks, B2B have users that need extra hoops as well.&lt;p&gt;But 23andMe. I would not expect them to take any extra steps.</text></item><item><author>somsak2</author><text>Even if this is the case, 23andMe should have done better here. Why are you letting people log into an account from a brand-new IP with no additional verification? You have their email, you could have at least done 2FA with that. And as other commenters mentioned, CAPTCHA would have also made this slower &amp;#x2F; more expensive. At my employer, we use both, and so it is not the case that this &amp;quot;could be done on literally any website.&amp;quot;&lt;p&gt;For such a mature business (that is publicly-traded, no less!) it is shameful to allow credential stuffing on the scale of millions of accounts.</text></item><item><author>Urgo</author><text>Unless I&amp;#x27;m reading this wrong all that happened was someone had an existing leaked database of emails&amp;#x2F;passwords and then tried them on 23andme, and if they worked they took the data they could get. Yes, 23andme has some pretty extensive and personal data, but this attack could be done on literally any website. The issue is people re-used passwords, and also did not have 2fa enabled.&lt;p&gt;So the database that is for sale is just a list of emails&amp;#x2F;passwords from other breaches that worked on 23andme, along with the data that 23andme had on those users.  Not exactly a 23andme breach.</text></item></parent_chain><comment><author>dash2</author><text>23andme isn&amp;#x27;t just any small company. They process people&amp;#x27;s DNA! It&amp;#x27;s about as personal information as you can get. And the stolen data included information about people&amp;#x27;s genetic ancestry. They should have very high-class security practices.</text></comment>
<story><title>23andMe says user data stolen in credential stuffing attack</title><url>https://www.bleepingcomputer.com/news/security/genetics-firm-23andme-says-user-data-stolen-in-credential-stuffing-attack/</url></story><parent_chain><item><author>codetrotter</author><text>&amp;gt; Why are you letting people log into an account from a brand-new IP with no additional verification?&lt;p&gt;Is that really feasible today? With widespread use of phones and laptops, most people probably have at least a handful of different IP addresses they regularly use (home WiFi, work WiFi, cellular connection) and then they randomly connect from new up addresses like those from libraries, coffee shops, commute, etc&lt;p&gt;I think most “normal” apps and websites today allow any random IP to log in without jumping through extra hoops.&lt;p&gt;Only companies with big budgets (Apple, Google, etc) make regular users jump through extra hoops.&lt;p&gt;Banks, B2B have users that need extra hoops as well.&lt;p&gt;But 23andMe. I would not expect them to take any extra steps.</text></item><item><author>somsak2</author><text>Even if this is the case, 23andMe should have done better here. Why are you letting people log into an account from a brand-new IP with no additional verification? You have their email, you could have at least done 2FA with that. And as other commenters mentioned, CAPTCHA would have also made this slower &amp;#x2F; more expensive. At my employer, we use both, and so it is not the case that this &amp;quot;could be done on literally any website.&amp;quot;&lt;p&gt;For such a mature business (that is publicly-traded, no less!) it is shameful to allow credential stuffing on the scale of millions of accounts.</text></item><item><author>Urgo</author><text>Unless I&amp;#x27;m reading this wrong all that happened was someone had an existing leaked database of emails&amp;#x2F;passwords and then tried them on 23andme, and if they worked they took the data they could get. Yes, 23andme has some pretty extensive and personal data, but this attack could be done on literally any website. The issue is people re-used passwords, and also did not have 2fa enabled.&lt;p&gt;So the database that is for sale is just a list of emails&amp;#x2F;passwords from other breaches that worked on 23andme, along with the data that 23andme had on those users.  Not exactly a 23andme breach.</text></item></parent_chain><comment><author>sfmike</author><text>Please don&amp;#x27;t make this normal it&amp;#x27;s absolutely tiresome to get codes for every single task</text></comment>