DNA testing packages are becoming increasingly popular, especially as gifts, but the sensitivity of the genetic information they collect has raised privacy alarms. Now add hacking to that list of concerns. DNA testing site MyHeritage said this week that more than 92 million users' email addresses and hashed passwords had been stolen, affecting any user who had signed up until October 26. The data had been sitting for months on a private server until an outside security researcher alerted the Israel-based company. MyHeritage said the breach didn't contain sensitive data such as DNA and individuals' family trees. But that personal data, such as users’ medical histories and biological relationships, can be accessed through legal means. More:Took an ancestry DNA test? You might be a 'genetic informant' unleashing secrets about your relatives More:Ancestry DNA tests: How accurate, how secure and how private? It was Florida-based GEDmatch, which pools raw genetic profiles that people share publicly, that led investigators to identify Joseph James DeAngelo as the "Golden State Killer," a suspect in the rapes and murders that terrorized California in the 1970s and ‘80s. MyHeritage's website states it only releases user data to third parties in “limited circumstances,” which include requests from legal authorities. Both Ancestry.com and 23AndMe have said they won't release information to the authorities unless they receive a court order. Not every DNA testing company has this policy, however: GEDmatch's privacy policy doesn’t have any requirement for a court order to release user data and even says that "users participating in this site should expect that their information will be shared with other users." Police in New Orleans used genealogy data from Ancestry.com to identify a local filmmaker as a suspect in a 2014 Idaho murder, but he was cleared after his DNA didn’t match what was found at the crime scene. His DNA had been sold to Ancestry after he had given it to a church-sponsored genealogy project years earlier. In response to the hack, MyHeritage advised its users to change their passwords and said it would be rolling out two-factor ID authentication. The company was advertising a $59 test kit that would help the user uncover ethnic roots and find new relatives. Contributing: The Associated Press<doc-sep>SAN FRANCISCO (BLOOMBERG) - Consumer genealogy website MyHeritage said that e-mail addresses and password information linked to more than 92 million user accounts have been compromised in an apparent hacking incident. MyHeritage said that its security officer had received a message from a researcher who unearthed a file named "myheritage" containing e-mail addresses and encrypted passwords of 92,283,889 of its users on a private server outside the company. "There has been no evidence that the data in the file was ever used by the perpetrators," the company said in a statement late on Monday. MyHeritage lets users build family trees, search historical records and hunt for potential relatives. Founded in Israel in 2003, the site launched a service called MyHeritage DNA in 2016 that, like competitors Ancestry.com and 23andMe, lets users send in a saliva sample for genetic analysis. The website currently has 96 million users; 1.4 million users have taken the DNA test. According to MyHeritage, the breach took place on Oct 26, 2017, and affects users who signed up for an account through that date. The company said that it doesn't store actual user passwords, but instead passwords encrypted with what's called a one-way hash, with a different key required to access each customer's data. In some past breaches, however, hashing schemes have been successfully converted back into passwords. A hacker able to decrypt the hashed passwords exposed in the breach could access personal information accessible when logging into someone's account, such as the identity of family members. But even if hackers were able to get into a customer's account, it's unlikely they could easily access raw genetic information, since a step in the download process includes e-mail confirmation. In its statement, the company emphasised that DNA data is stored "on segregated systems and are separate from those that store the e-mail addresses, and they include added layers of security". MyHeritage has set up a 24/7 support team to assist customers affected by the breach. It plans to hire an independent cyber-security firm to investigate the incident and potentially beef up security. In the meantime, users are advised to change their passwords. As consumer DNA testing has grown into a US$99 million industry, questions about the security of users' intimate data have increased as well. After investigators tracked down a suspect in the Golden State Killer case using a genealogy website that, like MyHeritage, allows users to upload raw genetic information, privacy concerns about shared DNA data have also surged.<doc-sep>The hack has exposed the emails of more than 92million MyHeritage users top stories direct to your inbox SUBSCRIBE Invalid email Sign up to receive our rundown of the day'sdirect to your inbox When you subscribe we will use the information you provide to send you these newsletters. Sometimes they'll include recommendations for other related newsletters or services we offer. Our Privacy Notice explains more about how we use your data, and your rights. You can unsubscribe at any time. The US-based site’s genetic division, MyHeritage DNA, enables people to put together family trees by comparing their genetic codes with other users. However, a statement released yesterday by Omer Deutsch, the company’s chief information security officer, said he had been sent a message by an independent “security researcher” who had discovered found a file named MyHeritage on a private server. This was found to contain a large quantity of information about everyone who had signed up with the site up to October 26, 2017. Mr Deutsch added: “Immediately upon receipt of the file, MyHeritage’s Information Security Team analysed the file and began an investigation to determine how its contents were obtained and to identify any potential exploitation of the MyHeritage system. MyHeritage DNA testing kits for sale at a conference in Salt Late City We determined that the file was legitimate and included the email addresses and hashed passwords of 92,283,889 users Omer Deutsch, MyHeritage's chief information security officer “We determined that the file was legitimate and included the email addresses and hashed passwords of 92,283,889 users.” He stressed that MyHeritage did not store actual passwords, but rather a “one-way hash”, in which the hash key differs for each customer, meaning that anyone gaining access this information did not have the actual passwords. Mr Deutsche added that no other data related to MyHeritage had been found on the server, and that there was no evidence that the data had ever been used by the perpetrators. He said: “We have no reason to believe that any other MyHeritage systems were compromised. As an example, credit card information is not stored on MyHeritage to begin with, but only on trusted third-party billing providers.” DNA genetic instructions used in the growth and development of all known living organisms "Other types of sensitive data such as family trees and DNA data are stored by MyHeritage on segregated systems, separate from those that store the email addresses, and they include added layers of security. “We have no reason to believe those systems have been compromised.” Mr Deutsch said the company had launched an investigation to identity how the breach had occurred, as well as contacting an independent cybersecurity firm to undertake “comprehensive forensic reviews” to determine its scope. Concerned users are being directed to MyHeritage’s customer support team via email on privacy@myheritage.com. A 24-hour, toll-free number is also provided, 001 888 672 2875. Mr Deutsche added: “For all registered users of MyHeritage, we recommend that for maximum safety, they change their password on MyHeritage. What is DNA and How Does it Work?<doc-sep>Over 92 million account details from genealogy and DNA testing service MyHeritage were found on a private server, according to a release made by the company on Monday. According to the release, the breach occurred on October 26th, 2017, and the data discovered includes users who signed up for the service on or before that date, totaling 92,283,889 people. MyHeritage is an Israel-based ancestry platform where users can create family trees and search through familial and historical records. MyHeritage became aware of the breach after a security researcher reached out to the company’s chief information security officer with “a file named myheritage containing email addresses and hashed passwords, on a private server outside of MyHeritage,” the release read. According to the researcher, no other data was discovered on the server. Other data, like the DNA data and credit card information, is stored in a separate system from those that house the username and email information. The company said there’s no reason to believe that the more sensitive information was breached. MyHeritage has since set up a response team that is investigating the incident and is “taking immediate steps to engage a leading, independent cybersecurity firm” to look into the scope of the breach. Correction 6/5/2018 2:55PM EST: This headline has been corrected to clarify that email account details were leaked, and not information regarding user DNA.<doc-sep>
On Monday, online genealogy company MyHeritage Ltd. released a statement revealing the emails of some 92 million of its users were stolen during a security breach dated October 26, 2017. Israel-headquartered MyHeritage enables users to create family trees by searching through historical documents such as census, immigration, marriage and burial records in 42 languages. In 2016, the company also launched a genetic testing service that provides both DNA matching and ancestry and ethnicity estimates. Its database currently has DNA samples from over 1.25 million people. MyHeritage founder and CEO Gilad Japhet. Photo: Shaul Golan The security breach was discovered by the company on Monday after an independent security researcher contacted MyHeritage's chief information security officer and revealed he had found a file containing email addresses and hashed passwords on a private outside server. The company determined the file was legitimate and contained the information of 92,283,889 users who had created an account up to the breach date. MyHeritage stated that it does not store user passwords but rather uses a one-way hash with an individual key for each customer. "This means that anyone gaining access to the hashed passwords does not have the actual passwords," the company wrote. Hashing is a form of encryption that means a password is mathematically converted into a seemingly random series of characters. When users enter their password on a website, the website doesn't use a key to decrypt it but rather performs the same hashing process again, confirming the results against the original hash. There are varying hashing schemes in terms of strength, but they are not uncrackable. In 2012 and 2016 almost 200 million LinkedIn user passwords went on sale following a 2012 breach, despite the fact the service hashed its passwords. MyHeritage has not seen any evidence that user accounts were compromised or that the data obtained was ever used by the perpetrators, the company stated. Furthermore, the company said it segregates its systems, meaning data such as family trees and DNA are stored separately from email addresses on systems with added security. The company does not store the credit card data of its users, instead using third-party vendors such as Paypal. Aside from informing users, MyHeritage stated it is taking steps to notify relevant authorities, as per GDPR. It has set up an information security incident response team, and also contracted an independent cybersecurity team to determine the scope of the breach and provide a recommendation regarding further steps and security measures. The company also stated it intends to roll out an optional two-factor authentication system, which will require users to use a separate device or service to authenticate identity. The company recommended that all users change their passwords.