<story><title>23andMe tells victims it&apos;s their fault that their data was breached</title><url>https://techcrunch.com/2024/01/03/23andme-tells-victims-its-their-fault-that-their-data-was-breached/</url></story><parent_chain><item><author>liquidise</author><text>So 23andMe failed to identify brute force and credential stuffing access of 14,000 accounts. They also have a feature that grants those 14k compromised accounts effective access to 6.9 million accounts.&lt;p&gt;23andMe then claims that poor password practices are responsible for this data leak.&lt;p&gt;&amp;gt; “Therefore, the incident was not a result of 23andMe’s alleged failure to maintain reasonable security measures”&lt;p&gt;I&amp;#x27;ve not run security at an org of their size, nor have i touched their service, but i have to imagine there were some patterns to this breach that would have been reasonable to account for ahead of time. Did those 14k accounts also have their email provider accounts compromised? Could a login ip-range check have prevented all of this? 2FA seems like an obvious answer here but clearly that was more than could be expected.</text></item></parent_chain><comment><author>dpkonofa</author><text>There was no brute forcing done. The credentials were from other sites that were leaked via Tor and the users on 23andMe used the same email&amp;#x2F;password combo. That’s why you don’t reuse passwords, when possible.&lt;p&gt;Nothing on 23andme’s end failed unless you consider someone using a correct user&amp;#x2F;pass combo while not being the owner as a fail on the part of 23andMe rather than the end user.</text></comment>
<story><title>23andMe tells victims it&apos;s their fault that their data was breached</title><url>https://techcrunch.com/2024/01/03/23andme-tells-victims-its-their-fault-that-their-data-was-breached/</url></story><parent_chain><item><author>liquidise</author><text>So 23andMe failed to identify brute force and credential stuffing access of 14,000 accounts. They also have a feature that grants those 14k compromised accounts effective access to 6.9 million accounts.&lt;p&gt;23andMe then claims that poor password practices are responsible for this data leak.&lt;p&gt;&amp;gt; “Therefore, the incident was not a result of 23andMe’s alleged failure to maintain reasonable security measures”&lt;p&gt;I&amp;#x27;ve not run security at an org of their size, nor have i touched their service, but i have to imagine there were some patterns to this breach that would have been reasonable to account for ahead of time. Did those 14k accounts also have their email provider accounts compromised? Could a login ip-range check have prevented all of this? 2FA seems like an obvious answer here but clearly that was more than could be expected.</text></item></parent_chain><comment><author>hibikir</author><text>I&amp;#x27;ve done identity for bigger places that have credential attacks all the time. There&amp;#x27;s sophisticated attackers that are aware of each victim&amp;#x27;s location and can get through geolocation anomaly detection, and there&amp;#x27;s such thing as hitting the jackpot through lucky credential stuffing, so any check for failed attempts doesn&amp;#x27;t hit. It&amp;#x27;s not possible to detect everything. There&amp;#x27;s a whole lot things a serious place will do to detect naive attacks though, so a whole lot of volume there fails. It might even be good to let an obvious stuffer keep attacking you, and help us mark the accounts they have working credentials for, so we can instantly lock them and ask for password changes.&lt;p&gt;I have no idea of the actual sophistication of the attackers here though: It&amp;#x27;s way too common to see big companies that have paid no attention to prevention, and therefore will only notice an attack if it becomes an accidental  denial of service attack. Maybe 23andme are sophisticated and only the worst shared passwords got breached, or maybe they have minimal security.</text></comment>