<story><title>Hacker leaks millions more 23andMe user records on cybercrime forum</title><url>https://techcrunch.com/2023/10/18/hacker-leaks-millions-more-23andme-user-records-on-cybercrime-forum/</url></story><parent_chain><item><author>murphyslab</author><text>&amp;gt; 23andMe blamed the incident on its customers for reusing passwords, and an opt-in feature called DNA Relatives, which allows users to see the data of other opted-in users whose genetic data matches theirs. If a user had this feature turned on, in theory it would allow hackers to scrape data on more than one user by breaking into a single user’s account.&lt;p&gt;23andMe&amp;#x27;s blame is an obfuscation of the problems which underlie this situation.&lt;p&gt;1.  There is the matter of having insufficient granularity in their sharing options within the DNA Relatives program. It comes with two general levels, which is not enough.&lt;p&gt;2. 23andMe limits one to seeing the closest 1500 matches who have opted-in to DNA Relatives. That would have allowed a hacker to collect data on most people in the database despite having only a few thousand compromised accounts. (Haplogroups, ethnic origins predictions, names, profile data, a list of relatives, and information on geographic origins.)&lt;p&gt;3. The 1500 match limit would be helpful, in theory, however for some time (recently) it was possible to see profiles &lt;i&gt;beyond&lt;/i&gt; those 1500 matches. I&amp;#x27;m not certain if these were limited to only those who shared matching DNA segments but who fell outside of the 1500 match limit. And I can&amp;#x27;t be certain if this was part of the method exploited by these malicious actors.</text></item></parent_chain><comment><author>Phemist</author><text>The 23andme page on &amp;quot;DNA relatives&amp;quot; says this though:&lt;p&gt;&amp;gt; If you choose to participate in the DNA Relatives feature, you have multiple privacy options to suit your individual preferences. For complete privacy, you can opt out of DNA Relatives entirely.&lt;p&gt;How is a feature opt-in if you need to opt-out to get &amp;quot;complete privacy&amp;quot;? What does complete privacy mean in this case and how does it compare to privacy that you can reasonably expect?&lt;p&gt;I call bullshit on their statement that the feature is opt-in.</text></comment>
<story><title>Hacker leaks millions more 23andMe user records on cybercrime forum</title><url>https://techcrunch.com/2023/10/18/hacker-leaks-millions-more-23andme-user-records-on-cybercrime-forum/</url></story><parent_chain><item><author>murphyslab</author><text>&amp;gt; 23andMe blamed the incident on its customers for reusing passwords, and an opt-in feature called DNA Relatives, which allows users to see the data of other opted-in users whose genetic data matches theirs. If a user had this feature turned on, in theory it would allow hackers to scrape data on more than one user by breaking into a single user’s account.&lt;p&gt;23andMe&amp;#x27;s blame is an obfuscation of the problems which underlie this situation.&lt;p&gt;1.  There is the matter of having insufficient granularity in their sharing options within the DNA Relatives program. It comes with two general levels, which is not enough.&lt;p&gt;2. 23andMe limits one to seeing the closest 1500 matches who have opted-in to DNA Relatives. That would have allowed a hacker to collect data on most people in the database despite having only a few thousand compromised accounts. (Haplogroups, ethnic origins predictions, names, profile data, a list of relatives, and information on geographic origins.)&lt;p&gt;3. The 1500 match limit would be helpful, in theory, however for some time (recently) it was possible to see profiles &lt;i&gt;beyond&lt;/i&gt; those 1500 matches. I&amp;#x27;m not certain if these were limited to only those who shared matching DNA segments but who fell outside of the 1500 match limit. And I can&amp;#x27;t be certain if this was part of the method exploited by these malicious actors.</text></item></parent_chain><comment><author>alwaysrunning</author><text>Wow. What a shit company. It isn&amp;#x27;t the user&amp;#x27;s responsibility to secure the data that you store, it is 100% on you. If the user is reusing a pwd that might be the reason a single account got hacked but to beat a dead horse, you can mitigate that easily as a company.&lt;p&gt;Karma seems to always work things out.</text></comment>