this post was submitted on 06 Oct 2023
381 points (97.0% liked)

World News

32285 readers
687 users here now

News from around the world!

Rules:

founded 5 years ago
MODERATORS
 

At least a million data points from 23andMe accounts appear to have been exposed on BreachForums. While the scale of the campaign is unknown, 23andMe says it's working to verify the data.

you are viewing a single comment's thread
view the rest of the comments
[–] [email protected] 87 points 1 year ago (7 children)

I can't believe people voluntarily sent them their DNA.

[–] [email protected] 72 points 1 year ago (1 children)

The worst part is it you have enough family members who used these services your details are likely on there too.

[–] [email protected] 17 points 1 year ago (3 children)

Though if neither a father nor his sons have submitted their DNA, the service will lack all that Y-DNA though, right? I'm glad I made the right decision to not send in my DNA to those sites, despite my sisters hounding me to do it after our dad refused, lol.

It's a shame though, because family genetic networking is interesting, but it just goes to show you can't trust these companies. (Even though the company didn't really do anything truly wrong in this case, as it's simply users reusing passwords, they still should have been better/more proactive especially with such sensitive information)

[–] [email protected] 30 points 1 year ago (1 children)

Even though the company didn’t really do anything truly wrong in this case, as it’s simply users reusing passwords, they still should have been better/more proactive especially with such sensitive information

There's nothing special or new or unique or unforseen about the security requirements of 23andMe.

They absolutely failed to implement an appropriate level of security measures for their service.

Mandatory 2FA could've prevented this.

[–] [email protected] 5 points 1 year ago (2 children)

Part of the issue is the average person using a service like this, and people comfortable with MFA don’t really overlap.

[–] [email protected] 13 points 1 year ago

I mean, too bad. You're accessing the results of your genetic data that contain sensitive personal information on relatives as well as yourself. Banks require 2FA, and people figure out how to use that.

[–] [email protected] 6 points 1 year ago (1 children)

Hence the key word: mandatory.

[–] [email protected] 1 points 1 year ago (1 children)

Oh I didn’t miss that. Would it be a good business decision for nascar to force people wanting to buy live tickets to eat a vegan meal?

[–] [email protected] 0 points 1 year ago

"We sent you an SMS with a 4 digit number, please type it in this box" is a pretty low bar.

[–] [email protected] 10 points 1 year ago

Y chromosomes have very little information on them, and the DNA there is pretty highly conserved. You're not really keeping any secrets by hiding your Y chromosome away.

[–] [email protected] 5 points 1 year ago* (last edited 1 year ago)

It's not really like they are storing DNA sequences anyways. They use a genotyping array which just reads ~650k single nucleotide polymorphisms (SNPs).

An analogy would be 23andme has a 6.4mil page book of DNA for a single customer but they only know the position and letter of single character on every tenth page. Sure it's enough to identify someone (You can confidently use 50 SNPs to identify these days) but it's not like 23andme was ever storing a whole genome

[–] [email protected] 18 points 1 year ago

They also sent your DNA involuntarily. You can be IDed of someone in your genetic vicinity has sent theirs. They don't even need to be super close.

[–] [email protected] 16 points 1 year ago (1 children)

I sent mine in because 75% of my DNA comes from sources unknown to me. It's been interesting seeing what pops up.

[–] [email protected] 9 points 1 year ago* (last edited 1 year ago) (3 children)

Top notch victim blaming you got there...

ETA because I don't engage with bigots:
Imagine that, the descendants of one of the biggest genocides in history want to try and piece their history together, and use the available tools to do it with, fucking shocker..
Then, when they continue getting targeted just for existing, privileged ignorant bigots who couldn't even imagine what having over 90% of their community gassed is like, and have never been oppressed for who they are a day in their lives, simply can't help themselves but jump to justify them being attacked again:

tHe bAstArDs dEseRve eVerYthInG tHey GeT!!11

And somehow not a word about the attackers, nor the company that failed its customers.

Sure, antisemitic Jan..🙄🙄🙄

[–] [email protected] 18 points 1 year ago (1 children)

"I can't believe this incredibly obvious thing happened!" Isn't really victim blaming, is it? They're not saying they did it to themselves or they deserved it, they're saying that this was bound to happen and people volunteered their DNA to a private company

[–] [email protected] 1 points 1 year ago

... Therefore blaming them for using the service.

Why even have a capitalist economy if private businesses can just abuse people like that and the customer is routinely blamed for participating in the economy the only way they're allowed to?

[–] [email protected] 5 points 1 year ago
[–] [email protected] 1 points 1 year ago (2 children)

You say that like it's a negative thing.

Some people actually want to know things and are curious about where they came from, what they're made of, who their family is.

Submitting your DNA can increase your knowledge. It sounds like you can't believe people would seek knowledge.

[–] [email protected] 13 points 1 year ago

I’d love to know all of that. I just don’t ever trust a private corporation to safeguard my highly personal and unique DNA information from:

  • a foreign scammer looking to make a buck
  • my government looking to close a case
  • a foreign government looking for kompromat
  • a health care company looking for reasons to deny coverage.

It’s too easy for a company to skimp on staff and digital security and then say “we’re soooo sowwwy, have 3 months of identity fraud protection on us” if they find a breach.

[–] [email protected] 6 points 1 year ago* (last edited 1 year ago)

The point I think you could be missing is that the organizations which do this have been at best irresponsible, at worst negligent, in protecting customers personal information. There are obviously benefits to ~~this~~ a genetic record. Preserving a comprehensive genetic record for future generations to study is one. A database for law enforcement to use to solve very serious crimes like murder and rape. All that would be wonderful, but that information is already being misused and abused. Most people, myself included, don't think these organizations will ever be responsible to their customers cause who the hell would believe that these days?

[–] [email protected] 0 points 1 year ago

There are a lot of dumb people that wanted to know they were a pure breed European or something to brag about like an IQ test

[–] [email protected] -1 points 1 year ago

But they trusted [youtuber]!!!