23andMe tells victims it's their fault that their data was breached

https://techcrunch.com/2024/01/03/23andme-tells-victims-its-their-fault-that-their-data-was-breached/

by skadamat • 3 years ago

261 355 3 years ago

it_citizen• 3 years ago

Remember that when you are giving your DNA to a company, you are also partly doing it for all your family members. Maybe talk about it with them before doing it, especially if it is just for fun.

travoc• 3 years ago

It's a security flaw in life itself.

y0ssar1an• 3 years ago

if it was truly a credential stuffing attack, then there's a shared responsibility between users and 23andme. 23andme is responsible for not enabling 2FA. the users are responsible for reusing passwords.

to me, the takeaway is that we need to roll out passkeys as quickly as possible.

eli• 3 years ago

Even if they didn't want to do 2FA for whatever reasons, there are things they could have done like checking password hashes against breaches.

bilekas• 3 years ago

11k people due to credential stuffing is not a dent in the 6+ million though. It's a disingenuous argument.

Not only that but they're should have been far better protected against even poor password management by users given the type of sensitive information they're handling.

Beldin3• 3 years ago

The service requires authentication, but then does not take the obvious steps (industry mediocre(1) practices) to ensure widely known problems with authentication are mitigated - let's not blame regular people for the failure of this service to secure their accounts.

(1) the bar to do better is quite a bit below "best practices".

yreg4• 3 years ago

2FA was enabled, just not mandatory.

liorben-david• 3 years ago

Is there a geneology service that does not store your data?

Any kind of storage is a non-starter.

pintxo• 3 years ago

Isn’t the whole point of such a service to store your data? To make it possible for others (genetically) related to you, to find you?

awinter-py2• 3 years ago

signal does some hash-based matching of your contacts without storing your contacts

(but also re 'whole point', not sure about split btwn people who want their own genetic profile vs searching for long-lost twin)

thedanbob• 3 years ago

If you mean just DNA analysis I suppose that's possible, but unlikely. Genealogy involves your links to specific other people and thus is impossible without storing data.

stuaxo• 3 years ago

This has to arrive in the next ten years or so, off the cloud - test at home.

GnarfGnarf5• 3 years ago

The whole point of DNA testing in genealogy is to quantify your connections with other people. So an isolated home test would be of no benefit.

GnarfGnarf5• 3 years ago

What kind of genealogy service could you provide if you did not store users' data?

awinter-py2• 3 years ago

every saas should have a byo storage option

unklefolk• 3 years ago

Does this mean that 2FA was not in place? For a company handling such personal information, this seems like a minimum requirement.

JohnMakin8• 3 years ago

In the article:

After disclosing the breach, 23andMe reset all customer passwords, and then required all customers to use multi-factor authentication, which was only optional before the breach.

MattGaiser3• 3 years ago

Often on discussions about 2FA and IP address checks on HN, there is a sizable contingent that is frustrated with how ever more security impacts how they want to use the product such as people wanting to be able not to own a smartphone while still doing online banking or using their credit cards overseas.

Add in all the people who struggle to use 2FA of any kind. At my first employer, I was there when they implemented it and it basically destroyed an entire week of productivity as so many people struggled to grasp how to set up a token in the authenticator app and use the token. I would be curious to know what the stats are on how 2FA impacts use and churn of users.

phatskat• 3 years ago

I can definitely understand this argument - imagining my dad setting up even SMS-based 2FA makes me shudder. However, for information this sensitive, it would have been smarter (imo) to strongly encourage 2FA, along with tutorials on how to set it up (articles, videos), and finally to add an option to not use it with a BIG SCARY WARNING and a consent checkbox.

Ultimately, companies like this are making the choice of information safety vs profits - it’s a tale as old as the free market.

block_dagger• 3 years ago

users negligently recycled and failed to update their passwords following these past security incidents, which are unrelated to 23andMe. Therefore, the incident was not a result of 23andMe’s alleged failure to maintain reasonable security measures.

23andMe's argument seems ridiculous on its face.

yreg4• 3 years ago

It doesn't seem ridiculous to me.

gkbrk2• 3 years ago

Why? You could have a 100% secure website, but if the user gives their credentials to someone else (another website in this case), and that website with bad security gets hacked and leaks the credentials, how is that their fault?

Spivak2• 3 years ago

Because we've known about credential reuse for 20+ years, developed multiple means to keep a site secure when it happens and then chose to not employ those security measures on data people broadly consider incredibly sensitive.

It is your job as a service provider to not allow access to anyone but the authorized user, how you do it is an implementation detail. You can't throw up your hands and say "well we decided that doing that is too hard so we're defining the authorized user as anyone who knows the password."

elektor• 3 years ago

As someone who is excited about the potential of using DNA tech for new drug discovery, I’m really sad to see 23andme handle this so poorly. I’m seriously considering not doing their periodic health surveys given this incident + them putting updated health reports behind a paywall.

Luckily I’m also in the NIH All of Us program and they’re at least better about data safety (for now?).

liquidise• 3 years ago

So 23andMe failed to identify brute force and credential stuffing access of 14,000 accounts. They also have a feature that grants those 14k compromised accounts effective access to 6.9 million accounts.

23andMe then claims that poor password practices are responsible for this data leak.

“Therefore, the incident was not a result of 23andMe’s alleged failure to maintain reasonable security measures”

I've not run security at an org of their size, nor have i touched their service, but i have to imagine there were some patterns to this breach that would have been reasonable to account for ahead of time. Did those 14k accounts also have their email provider accounts compromised? Could a login ip-range check have prevented all of this? 2FA seems like an obvious answer here but clearly that was more than could be expected.

hnarn2• 3 years ago

A service that handles sensitive personal data should absolutely have mandatory 2FA. Calling anything else “reasonable security measures” is laughable.

reactordev3• 3 years ago

This. Saying “It’s not our fault, it’s yours.” isn’t going to fly when the government comes looking. I remind everyone that there’s a new law about data breaches in effect. [1] The FTC will want to know what their security posture is and whether that meets HIPAA compliance rules or not. If not, they may lose their HIPAA compliance and be barred from applying, rendering their whole operation illegal under the FTC (s/you can only collect health information under HIPAA/you can but you still need to notify the FTC when you’re breached/).

This is a serious HIPAA violation not just a security breach. This defense of theirs isn’t a smart strategy if they want to stay in business not to mention the impending lawsuits.

*edit* forgot the link

[1] https://www.ftc.gov/business-guidance/resources/complying-ft...

[2] https://www.ftc.gov/legal-library/browse/rules/health-breach...

yreg4• 3 years ago

I don't think 2FA should be mandatory. Leave that decision to me, the user.

H8crilA• 3 years ago

Imagine you already know the passwords for many emails, or likely password patterns, from other sources. That's the kind of the attack we're talking about here. Also, those attacks are normally performed very slowly, and probably through botnets.

(And yes, 2FA is the only real answer here, preferably YubiKeys to also defeat phishing)

browningstreet• 3 years ago

2FA is so, so, so very tiring.. all day long, 2FAing. We need to move past it. And no, I don't have an answer for it.

chimeracoder2• 3 years ago

(And yes, 2FA is the only real answer here)

It's not the only answer. You can also use tools that detect and reject insecure passwords, integrate with HaveIBeenPwned to force-roll passwords that have been previously compromised, etc.

2FA would solve a lot of the problem, but it's not the only option that could have mitigated this.

rpastuszak• 3 years ago

23andMe then claims that poor password practices are responsible for this data leak.

My account (now removed) relied on a long, unique, generated password + Apple SSO. I don't see how I could've made my 23andMe account more secure (I'm in the 6mm pool of users, not the original 14k).

dpkonofa34• 3 years ago

There was no brute forcing done. The credentials were from other sites that were leaked via Tor and the users on 23andMe used the same email/password combo. That’s why you don’t reuse passwords, when possible.

Nothing on 23andme’s end failed unless you consider someone using a correct user/pass combo while not being the owner as a fail on the part of 23andMe rather than the end user.

drcongo2• 3 years ago

How does something leak on Tor?

MattGaiser3• 3 years ago

Nothing on 23andme’s end failed unless you consider someone using a correct user/pass combo while not being the owner as a fail on the part of 23andMe rather than the end user.

This seems to be the big societal discussion, in the same way that people blame banks for them sending money to crypto and romance scammers overseas.

toomuchtodo6• 3 years ago

If you’re not providing secure MFA as an option and invalidating breached credential pairs via HIBP, you’re negligent as an idp. 23andme failed hard, and they should own it.

FFS, default to magic link login via email if you have to. At least then you're relying on Google, Apple, or someone else for auth (in most cases of unsophisticated users).

tuetuopay2• 3 years ago

Nothing on 23andme’s end failed unless you consider someone using a correct user/pass combo while not being the owner as a fail on the part of 23andMe rather than the end user.

Well not recognizing you have 14k logins coming from the same place, possibly with a lot coming from someplace else than the last login on the account, is definitely a failure on their part. That's why more and more websites send you emails to allow logins from a new location. Or have login rate-limiters (too many request from your network).

uses• 3 years ago

In 2023 an org of their size and with such sensitive data needs to give a bit more of a fuck about who is accessing users' accounts. Mass leakage of potentially reused credentials is an ancient concept at this point and should have been on their radar as an attack to protect their users' data against. Basically, they shouldn't have just been relying on passwords to authenticate users. Many orgs of their size and with much less sensitive information than the literal genetic data of their users do a lot better.

mvdtnz8• 3 years ago

Nothing on 23andme’s end failed

Other than allowing at least 14,000 login attempts from the same system without blocking suspicious activity. Nor using services like haveibeenpwned to prevent users from reusing passwords.

dvngnt_• 3 years ago

for sensitive data, logging into an account from a new IP should trigger an email for verification

jkaptur• 3 years ago

Users reuse passwords. We've had decades of trying to educate people to do something else (use a password manager! come up with a unique password and keep it in a little book! anything!) but it simply hasn't worked.

That's an engineering fact. It would be good if it weren't true, just as it would be good if virtual memory were indistinguishable from RAM, but it just ain't so.

To be a responsible engineer, you've got to design and build for the real world, and that means not relying solely on username and password for extremely sensitive data.

esrauch2• 3 years ago

Cambridge Analytica also didn't literally hack data or have it shared without a person doing something, right?

It seems the part where 14k leaked credentials provided access to millions of users data is where it becomes their responsibility. It means that people who were fully responsible still had their information leaked because of overexposure of the information.

morsch• 3 years ago

They could force their customers to use MFA. I'm sure they considered it and decided they'd rather have the additional income. At the same time, my bank doesn't let me opt out of MFA. Why? Regulation. That's the answer in this case, as well.

codegeek• 3 years ago

This is why MFA (not SMS based) is so critical especially for services like this. I sometimes hate it when it is forced on me as a consumer but for these types of services, it absolutely must be enforced. Kinda cop out for 23andME to just blame the users even though users should take some blame of course.

In 2024, if you want to access a highly sensitive database, you must be forced to setup MFA at the minimum. My opinion.

AnimalMuppet2• 3 years ago

Let me make sure I've got this right before I shred you.

14,000 users messed up. As a result, hackers were able to log in to 23andMe's computers as those users. (Is that the fault of those users? Absolutely.)

The hackers were able to use those logins to steal the data of 6.9 million users, approximately all of which did nothing wrong. How is that part not the fault of 23andMe?

shapenamer• 3 years ago

Tech savvy and privacy-conscious enough to use TOR, but not enough of either of those things to both use a service like 23andMe, and not use password keeper or just be aware that reusing passwords is dangerous. What a strange intersection of users.

tlavoie• 3 years ago

Well, there were 14K hits from some list of leaked credentials. That likely means that someone was banging away for a good long time, mostly not getting in.

While there could be a raft of IPs working in concert, there should be enough commonality to simply be an annoying target, black-holing IPs that attempt more than a couple times.

llm_nerd• 3 years ago

It's hard to detect credential stuffing. If people reuse passwords[1] they are going to have a bad time. Maybe they could have automatically locked accounts that appear in compromises, and while they should do that, I wouldn't go so far as saying they must do that.

Maybe they could have detected the exfiltration, but maybe they couldn't. If the hackers were smart they would have properly distributed the calls and rate limited to avoid detection.

effective access to 6.9 million accounts

The relatives feature lets you -- if you opt in -- see your DNA relatives and their very basic details, and vice versa. I have literal thousands listed, and those thousands, all over the globe and of mostly minuscule relations, can see mine. That really is being a bit overwrought as a facet of this.

robobro• 3 years ago

What is [1] referencing?

mvdtnz8• 3 years ago

There are lots of ways to mitigate against credential stuffing. There are methods to detect botnets accessing your system at scale. There are products like HIBP that can help prevent credential re-use. You can prevent logins from unusual locations with an additional factor ("it looks like you're accessing this website from Croatia when you've only ever logged in from California, check your email for a confirmation code"). You can force MFA if you want to go nuclear.

hibikir• 3 years ago

I've done identity for bigger places that have credential attacks all the time. There's sophisticated attackers that are aware of each victim's location and can get through geolocation anomaly detection, and there's such thing as hitting the jackpot through lucky credential stuffing, so any check for failed attempts doesn't hit. It's not possible to detect everything. There's a whole lot things a serious place will do to detect naive attacks though, so a whole lot of volume there fails. It might even be good to let an obvious stuffer keep attacking you, and help us mark the accounts they have working credentials for, so we can instantly lock them and ask for password changes.

I have no idea of the actual sophistication of the attackers here though: It's way too common to see big companies that have paid no attention to prevention, and therefore will only notice an attack if it becomes an accidental denial of service attack. Maybe 23andme are sophisticated and only the worst shared passwords got breached, or maybe they have minimal security.

tamimio• 3 years ago

In security, it should be ALWAYS assumed that the users are naive and will use the least possible means for an account security, it is the responsibility of the service provider to enforce these policies, let’s see:

- Did 23andMe enforced a strong password policy during the account creation with X minimum and combination of chars with complexity meter?

- Did they send a periodic reminder about account security, update passwords, secret questions and the likes?

- Did they enforce the 2FA?

- Failed authentication attempts count?

And those on top of my head, NIST, PCI and other standards have more details about those, in fact, the security level should be provided by such services should pass more than the “standards”, as once these data are leaked, you won’t be able to change it, so blaming that in the users shows the lack of accountability, glad I never trusted my DNA in any of these services.

notfed• 3 years ago

Requiring 2fa is the only real answer here here, your other suggestions are unnecessary red tape. (A strong password can still be reused. Periodic reminders will 100% be ignored. Failed auth count is silly because it falls back to 2fa, so just always require 2fa?)

JohnMakin8• 3 years ago

The fact that they immediately enforced MFA after the breach shows they know exactly how culpable they are.

Spivak2• 3 years ago

Yeah, that's a pretty dumb movie on their part to immediately mitigate the attack and show the whole world it was possible the whole time and it was via an industry accepted best practice.

Why people don't get that TOTP is just "strong unique password" you can enforce from the service provider side is beyond me.

keepamovin• 3 years ago

That's a great title. I love how they've encapsulated judgment, jurisprudence and execution in a single sentence! Mastery of "journalistic" hangfolken. hahahah :)

Slapshot_gd• 3 years ago

“Therefore, the incident was not a result of 23andMe’s alleged failure to maintain reasonable security measures”

In all honesty, you can hardly make this claim unless they properly communicated and mandated (at least in writing, since I can't imagine how it could be actually enforced) that users chose/pick passwords different from other platforms. Or at the least enforce an aggressive password change schedule, etc...

ziddoap8• 3 years ago

at least in writing, since I can't imagine how it could be actually enforced

You can check passwords against known-compromised lists and then tell the user "sorry, please use a different password". This is something that is a recommended best practice, and has been for at least a few years.

Or at the least enforce an aggressive password change schedule

This has been explicitly not recommended since at least 2016 by NIST. Research has shown this leads to password fatigue, which results in weaker passwords that are just iterated on (password1 -> password2 -> password3).

programjames3• 3 years ago

Or, users can check their passwords against known-compromised lists. It's not on them to hold users' hands and check for their mistakes.

ballenf• 3 years ago

Such information would only be available if plaintiffs affirmatively elected to share this information with other users via the DNA Relatives feature.

I'm skeptical that 6.9 M users opted-in to an off-by-default setting. That seems absurdly high for any opt-in feature that involves nebulous user value. I don't use 23andme, but I'd love it if someone had screenshots of this supposed "opt-in" before the data breach.

Also, how far does the sharing go? How far removed from a family member does a user have to be to see their info? Going from 14k to 6.9M seems like it must have been more than just immediate family, given the small family size common today.

MattGaiser3• 3 years ago

Also, how far does the sharing go? How far removed from a family member does a user have to be to see their info? Going from 14k to 6.9M seems like it must have been more than just immediate family, given the small family size common today.

Looking at mine, it shows me 4th cousins and closer. So way more than immediate family.

The user value isn't nebulous. If you are curious about your ancestry, you might also be curious to see what people you discover or see if your family tree is your real family.

crazygringo10• 3 years ago

It seems pretty plausible to me, because finding relatives -- especially unknown ones -- is one of the 3 main use cases of the product (the other 2 being understanding your ethnic background and health/disease markers).

They have ~14M users total, so this is 50% of them opting in. That seems entirely reasonable.

progval• 3 years ago

This is 50% of them opting in AND being considered relatives to the 14k who reused vulnerable passwords. For all we know, there may be 99% opt-in but only half the opt-ins are "relatives".

ysavir• 3 years ago

But how does the hacker get the DNA data? A feature to find relatives is one thing, exposing all those relative's DNA to the current user is another thing entirely. All the math would be done on the backend, not exposed to the end user, no? Or is the implication here that by getting DNA on the 14k compromised users, the attackers can draw meaningful conclusions on the DNA of those in their network?

turquoisevar5• 3 years ago

It’s a bit of a half truth.

The opt in is a prompt presented during onboarding with language that mainly focuses on “connecting and “exploring” who you’re related to.

The prompt is similar in mobile but here[0] is a screenshot of what it looks like on the web.

The fine print talks a little about what you’re sharing.

Where the lie comes in is that after selecting “Get Started” it also automatically enables sharing your ancestry report and the other default privacy settings are very permissive and work on an opt-out basis.

If doesn’t, for example, then give you through the settings and asks what you want to share. It enables everything by default.

0: https://int.customercare.23andme.com/hc/article_attachments/...

pompino9• 3 years ago

“ 23andMe knew or should have known that many consumers use recycled passwords ”

How would they know this?

squigz• 3 years ago

There's at least 1 service [1] that allows checking previous data breaches for compromised emails/passwords. I imagine there's others, too.

https://haveibeenpwned.com/API/v3

pompino9• 3 years ago

There is no way to verify that the usernames from the leaks are the same person as your users.

shermantanktop5• 3 years ago

How could they not know this? This is common knowledge for anyone involved in online consumer security. And the correctness of this common knowledge is beyond dispute, with numerous publicly-known breaches traceable to this practice, as well as the development of scaled, repeatable attack methods associated with it.

The only way they could have not known is if they failed to employ or consult with the appropriate professional expertise in this area.

kazinator5• 3 years ago

No, how would they know this for any given password?

Gashibyu@gyoryana3: is that recycled, or freshly minted?

pompino9• 3 years ago

Can you decribe a mechanism to verify that users in an alleged leak are the same users as your own?

porkbeer• 3 years ago

Its not like they dont already provide this to police and governments without a warrant and sell the data. If you expected your most personal data to be secure with them you havent been paying attention.

autoexec2• 3 years ago

Yep. Anyone who uses 23andMe has already compromised their personal information. It was never going to end well for them.

dahinds• 3 years ago

https://www.23andme.com/transparency-report/

1B05H1N• 3 years ago

They prioritized earning new business and lowering customer friction over enforcing MFA. They also had no idea 14k accounts were brute forced and cred stuffed, so that's 100% on them. They have enough money to do the security work.

ziddoap8• 3 years ago

On one hand, I have to somewhat agree with 23andMe here. If someone uses the password "password1" for some service, they should not be able to turn around and blame that service when their account is compromised.

On the other hand, 23andMe should have definitely done much more to reduce the blast radius of this attack. Mandatory 2FA, disallowing known-compromised passwords, geolocation of login IPs, etc.

I guess the question shakes out to: where do we draw the line on personal responsibility vs. service responsibility? Services can't be responsible for 100% of user security. But they also can't be negligent in their own security and mitigations.

JohnMakin8• 3 years ago

Where your first argument falls apart is the other several million users who had their data breached didn’t have compromised accounts. It quite literally isn’t their responsibility or problem at all.

ziddoap8• 3 years ago

They opted-in to the sharing feature though?

dpkonofa34• 3 years ago

They shared their info with a compromised account. If you didn’t share your DNA matches with the other person, you would have nothing to worry about.

lolinder7• 3 years ago

When you send people secure information through any means, you are accepting that the security of that information is now equivalent to the worst level of security practices of all the people who received that information. When the recipients are a large collection of random strangers on the internet, you should assume the data is as good as public, because the average random stranger on the internet has terrible security practices (not to mention the non-zero probability that they're actively malicious).

23andMe could have done a better job communicating the risks of sharing your data with random strangers on the internet, but it's also not unreasonable for them to put some level of blame on users. If you wanted to treat that information as secure, you shouldn't have opted in to sharing it with an arbitrary number of strangers.

Rudism3• 3 years ago

Those users signed up for a service with poor security controls (no 2FA, no requirement to rotate passwords at regular intervals) and then checked a box saying "share my data with other accounts."

So while I agree with you that those users are not responsible for the accounts that were actually compromised, they were fully responsible for sharing their data on that service without fully thinking the implications through. 23andMe is not blameless--it's their poor security controls that allowed it to happen in the first place--but I strongly feel people do not take security and privacy as seriously as they should and as a result do share at least some of the blame.

Beldin3• 3 years ago

On one hand, I have to somewhat agree with 23andMe here. If someone uses the password "password1" for some service, they should not be able to turn around and blame that service when their account is compromised.

I call BS. If the service thinks the user's password is acceptable to perform authentication, how should a user know they are actually wrong about that?

Either it is flawed, and therefore the service's job to catch, or it is acceptable. But the service doesn't get to say afterwards "haha, that was really dumb of you, you should have used a stronger password".

ziddoap8• 3 years ago

Either it is flawed, and therefore the service's job to catch, or it is acceptable. But the service doesn't get to say afterwards "haha, that was really dumb of you, you should have used a stronger password".

You are missing the category of attack that happened here.

The password was acceptable. But the users used the acceptable password on multiple websites. A different website was breached, and the password was leaked.

It is not 23andMe's responsibility to check if other services are breached, cross-reference the users in that other service, get the leaked password list, and then see if those leaked passwords are currently in-use on their website on accounts that are used on both sites.

However, as noted in my top-level comment, they should be checking against known-compromised passwords at password creation/change time, and disallow those.

cm2187• 3 years ago

You don't even need to bug your users with those pain-in-the-ass 2FA. Just don't let them chose a password, send them a strong random one by email when they signup. If their mailbox is compromised, it is game over anyway as it allows an attacker to reset every password.

Rebelgecko2• 3 years ago

IMO the problem is that even if you have the best most secure alphanumericpunctuated leetspeak 20 character password, your data was still compromised if your third cousin once removed had "hunter2" as their password.

It's like Cambridge Analytica- each compromised account let them dump data for hundreds to thousands of people

ziddoap8• 3 years ago

your data was still compromised if your third cousin once removed had "hunter2" as their password.

And you opted-in to share your DNA data.

But yes, the entire business model of 23andMe makes me uncomfortable. But it's a bit removed from the password security stuff I wanted to focus on, especially as the password security stuff is applicable to any type of service.

jmoak3• 3 years ago

Just a reminder that you can (...and should?) request to delete your account and associated data [0][1].

[0] https://www.washingtonpost.com/technology/2023/10/12/23andme...

[1] https://customercare.23andme.com/hc/en-us/articles/212170688...

drdaeman4• 3 years ago

Just a reminder that despite whatever their front page advertises, while your account will be marked as "deleted" (23andMe still retaining your email address and some other pieces of information), your genetic data won't be deleted:

23andMe and the contracted genotyping laboratory will retain your Genetic Information, Date of Birth, and sex as required for compliance with legal obligations, pursuant to the federal Clinical Laboratory Improvement Amendments of 1988 and California laboratory regulations.
23andMe will retain limited information related to your data deletion request, such as your email address and Account Deletion Request Identifier, as necessary to fulfill your request and for the establishment, exercise or defense of legal claims.

And that's why I don't use 23andMe, even though I'm quite interested in the product and was super tempted to buy. Just because it's not future-proof, and that's a deal breaker.

If you know of a DNA sequencing service that can do its job, send the result, then destroy every sample and every bit of information they had (save, possibly, for the payment receipt), please let me know. Don't care about ancestry, relatives and other social stuff, just the raw genetic data.

IceTDrinker• 3 years ago

As long as there is no dissuasive penalties this will keep happening

_jal• 3 years ago

If we're going to blame the victims, at least do it right - the mistake was submitting sensitive information to a gross, sketchy outfit like 23andMe.

Much like Uber, self-enshitification was obviously the "???" part of the underpants gnomes' plans.

electrodeyt• 3 years ago

I wonder if they (23andMe) can sleep at night after telling innocent people that something was their fault

khazhoux2• 3 years ago

If you read the article, it discusses how the initial breach was due to users using same password for 23 as on other sites. It’s really very difficult to guard against that, no?

codelikeawolf3• 3 years ago

This is like a home security provider blaming the victims of a break-in for not changing their locks every 6 months. Just take the L and own up to it, 23andme.

dpkonofa34• 3 years ago

That’s not at all what it’s like. This is like using the same PIN for your work lock and home lock and then blaming the lock maker when thieves from work got into your house because they found your address in the stuff they stole from your work.

codelikeawolf3• 3 years ago

My bad, I skimmed the article and must have misunderstood. Fair point.

khazhoux2• 3 years ago

Bad analogy. The issue was passwords used on multiple sites. Nothing to do with rotation.

codelikeawolf3• 3 years ago

Yep, you're right. I skimmed the article and misunderstood.

vel0city4• 3 years ago

Its getting mad at the home security provider because you made a hundred copies of your house key, sprinkled them all over the town with your address on a tag, and someone managed to get into your house.

arp242• 3 years ago

I think 23AndMe could perhaps have done better in detecting this sooner – "perhaps" because with a sufficiently large botnet that's not so easy to detect quickly and details are not available AFAIK.

But other that that, I ... kind of agree with 23AndMe: users should be primarily responsible for their own accounts. I don't like the "assume all users are blubbering morons and treat them as such" security model, and then blame $corp for treating their users as adults. Again, 23AndMe could have done better, maybe, but I strongly disagree that they're primarily responsible – at best they're partly responsible.

And maybe 23AndMe also could/should have pushed 2FA harder, I don't have an account so don't know how hidden this feature was or not. All I know is that mandatory 2FA is a right pain for me, adds basically no security for me because I just store it in my password manager next to the password. For TOTP it's just an inconvenience, but I really dislike phone-number based 2FA – I've been locked out so many times...

LargeTomato• 3 years ago

My cousin has some of my DNA in her DNA. She blundered it away. I wish 23 and me had treated her like the blubbering fool she is.

maerF0x03• 3 years ago

As mentioned in the article, a few mitigations could have been applied to mitigate, though not eliminate. None of these are perfect, nay sayers will pop up lamenting "it wouldnt work" but the point is it would help.

1. Fraud detection on the metadata like IP address, access timing, access patterns etc. eg: Why is a person from UK logging in from China IP?

2. IMO orgs should be importing and refusing known leaked credentials and the top 1000 passwords. This could happen both at password set time ("You cannot use that password as it's a known leaked credential, click here for more info about the breach"), or at login time "You're using a leaked credential, please follow the password reset flow".

vel0city4• 3 years ago

Why is a person from UK logging in from China IP?

And then we get to the other side of this where people get locked out of accounts because they went on vacation and bothered to check their email.

And often times these "person from UK logging in from a China IP" are massively wrong. For the longest time my home IP was showing up as from another country in most GeoIP databases. They're routinely trash.

theragra• 3 years ago

I think best solution is to do this for users without MFA. That way we wont suffer for their sins.

maerF0x03• 3 years ago

The only good thing I have to say about lastpass is that they allowed you to allowlist countries you wanted a login from. Like calling your credit card company, I'd login and add a country if I was traveling.

MBCook• 3 years ago

You always know you’re in a strong position when you have to resort to “stop hitting yourself” or “don’t make me hurt you, I don’t like it when you make me hurt you”.

shermantanktop5• 3 years ago

23andMe, Ancestry.com, and similar sites have extreme appeal to some of the oldest and least technical users. It's grandmas and grandpas who are willing to pay $20/month for a DNA site. The Venn diagram of DNA site users and online/telephone scam victims has to have a big overlap.

This is a tough population to increase the security for. They are highly vulnerable to social engineering, reuse passwords, use weak passwords, and struggle mightily with 2FA or other methods. But that's the gig, it's on 23andMe to solve it.

karaterobot• 3 years ago

On the one hand, I sympathize with anyone whose data is stolen in a data breach, we've all been there (and some of us have three dollars from Equifax lining our pockets to prove it).

On the other hand, I remember thinking ten years ago or whatever: "23AndMe sounds cool, I'd love to know about my ancestry and genetic risk factors, but that's a crazy amount of intensely personal data to trust a corporation with, so I guess I won't do that." And I'm as dumb as a rock, so if I made that decision with the same information as everyone else, it must have been pretty obvious what the consequences could be.

kazinator5• 3 years ago

Here is the thing: unless the attackers got into these accounts by guessing weak passwords at the login page, 23andMe are at fault.

The data breach by which attackers get their hands on passwords isn't the fault of the users.

Only the consequence of that breach to some of the users is their own fault.

compsciphd2• 3 years ago

So I'm a user of 23andMe. I have DNA relatives on (dont find it that useful though), but I don't really see much "DNA" in terms of "my relatives" (I've also never accepted anyone to see any of my profile, I just see who they say are relatives and how close they are (first/second/third cousin and so forth).

I assume most people are the same.

Therefore, I'm not sure what significant information an attacker could have gotten on me. Anyone care to enlighten me?

crazygringo10• 3 years ago

Yeah, this is my understanding too that if you weren't reusing passwords, then basically all they know is a little bit of your family tree.

Which is probably mostly already pretty discoverable through public records, obituaries, and genealogy sites.

It's not like 23andMe is telling you that your third cousin has some specific genetic risk for a disease, right?

turquoisevar5• 3 years ago

It's not like 23andMe is telling you that your third cousin has some specific genetic risk for a disease, right?

So… about that: https://ibb.co/hRmgRQy

Edit: Keep in mind the default is “Yes”

iamleppert• 3 years ago

23andMe is such a bizarre service to me. I have absolutely no desire to find out the details of some long lost cousin I don’t know, or know there is a chance I’m 2% Viking. Or have the chance to develop some weird kind of cancer because some post doc working in a papermill published a paper.

I would have never guessed people would be interested in such useless information.

NoZebra120vClip• 3 years ago

As the family genealogist, I completely agree. 23andMe had such minimal utility in comparison to the first service where I tested. At most, it corroborated and confirmed what I already knew and had been told. Also I identified the strongest possible genetic match, a person who hadn't tested elsewhere.

But 23andMe's cutesy haplogroup classifications, their faux historical narratives, the ridiculous litany of "health conditions" they warn me about, it's bunk, 100% bunk. Plus, no medical professional will accept this data as diagnostic, so why bother?

dandesim• 3 years ago

6.9 million accounts had information stolen because they were "relatives" of 14,000 users? Something doesn't add up there. That would mean each of those random users had 492 "relatives" on the platform. I've never used 23andMe for fears of exactly this, but they should look at recalibrating what the term "relative" means if you're opting in to sharing genetic information. The average Facebook user has 338 friends, as a point of reference, and I sure wouldn't want my information shared with those people.

tzs2• 3 years ago

They go out to 4th cousins. I've got 1500 people that 23andMe says are my relatives.

6.9 million accounts had information stolen because they were "relatives" of 14,000 users? Something doesn't add up there.

It adds up. The key is that for the attackers to get my data they only have to compromise 1 of my 1500 relatives.

14 000 out of 14 000 000 accounts were compromised, so 1 in a 1000.

In other words the attacked has 1500 chances to roll a 1 on a d1000 if they want to get my data. The probability they can do that is 1-(1-0.001)^1500 which is 0.78.

If everyone had about as many relatives as I do, we'd expect the attackers to get data on nearly 11 million people from those 14 000 compromised accounts. Getting "only" 6.9 million suggests that on average people have a little under 700 relatives.

Ekaros2• 3 years ago

So from now on does everyone here check each login from any user against known vulnerable password lists or known leaks? As new compromises might appear after password has been set or changed...

tzs2• 3 years ago

It's not clear to me, due to the particular nature of the data in this breach and why it was available to the 14 000 compromised accounts, that it getting breached will actually cause any damages.

This is data that appears in the ancestry data for the 14 000 compromised accounts. Your data only appears in another account's ancestry data if you opted in to sharing ancestry data and they are a relative of yours. I think most people opt in, because (1) finding out about your ancestry and relatives is one of the main reasons people use services like 23andMe, and (2) even people who started using it just for the health data often get curious and start using the ancestry stuff too.

23andMe counts anyone who is a 4th cousin or closer as a relative, which results in some big relative lists. Mine has 1500 other 23andMe users in it, but that might be above average. Based on 23andMe having 14 million customers, 14 000 accounts being compromised, and 6.9 million accounts having data taken via the relatives lists of those 14 000 compromised accounts, and assuming that everything that I don't have any data on is is pretty evenly distributed (the statistical equivalent of a spherical cow) I'd guess that the average is around 700.

If that's even in the right ballpark then when you opt in to sharing this data you are opting in to share it with several hundred people, mostly complete strangers to you, mostly scattered all over the US and a few foreign countries.

At that point I'm not sure if the different between just sharing it with them and sharing it with the world is meaningful.

1vuio0pswjnm7• 3 years ago

According to this filing, as of 29 Dec 2023, there are 35 cases filed against 23andMe so far based on this incident.

https://ia904506.us.archive.org/10/items/gov.uscourts.cand.3...

Almost all of them are in N.D. Cal but there is one filed in N.D. Ill. and one in C.D. Cal.

PudgyWudge200• 3 years ago

What an absolute farcical state of affairs here from 23andMe.

dekhn9• 3 years ago

To be honest it's amazing they are still in business.

The company was originally founded on unreasonable goals in the health industry, using DNA array testing to identify risky variants in individuals to help produce better treatments.

It took the CEO about a decade to learn enough to acknowledge that their approach would never have achieved this, because the mapping from genome to risk/treatment is a highly complex function and their mechanism was underpowered and they also repeatedly pissed off and ignored the FDA who then shut them down for a while. The only reason they survived this was, afaict, the CEO's ability to extract money from google to keep operating.

Eventually, the company found that they could do identity by descent really well, much more useful to customers than telling them their earwax properties, and their "recreational genomics" products were extremely popular- enough to sustain a service, but not really enough to sustain advanced research.

They finally got some pharma to give them a bunch of money for their data (basically all the genomic and phenotype data that they collected on their users) ostensibly to do translational health research, but this has not been very productive (and seems unlikely to be truly transformative).

In the meantime they have to keep runing their consumer platform and it clearly had security issues that permitted a large scale data extraction (that's on them, not the customers) and I jusrt can't see how they keep getting money to operate, because their track record in translating data to profit/medicine has been so skimpy.

myth_drannon• 3 years ago

All the other DNA test companies(MyHeritage, Ancestry) use DNA kits as a funnel to the more lucrative genealogy subscription services. But that market is pretty crowded and established, so 23andME is stuck in trying to sell DNA data.

ravenstine2• 3 years ago

Better yet, is it at all feasible to do at home for a Hacker News type with the right equipment and not breaking the bank?

shmatt2• 3 years ago

It cost me about $99 to get my DNA mapped by them a decade ago. I used a 3rd party service to sync my results with SNPedia which returned a pretty cool report, at the top of the report was a very dangerous gene I was the first in my family to discover, and has since saved lives. 23andme added that gene to their reports at least 5 years if not more later

My doctor scoffed at 23andme finding a dangerous genetic mutation and said its probably just a false positive. I had to spend $500 to get a single gene tested in a hospital, still came out positive.

So bang for your buck that $99 was a great deal for a full mapping, it feels like most of their issue is what the government allows them to show. Im pretty sure that SNPedia syncer isn't online anymore, but that was what made 23andme a great service for me

ramraj072• 3 years ago

I'm happy that this found a dangerous mutation in your family and saved lives but what's at stake is unfortunately much larger and not worth the risk for most people IMO. You are risking the publication of the genetic makeup and vulnerabilities not just of yourself but thousands of people living today and will live for the next several generations, and to some extent in perpetuity. I don't want to condemn my family to that risk yet! I'm sincerely hoping a security first service that actually earns it's trust shows up soon!

giantg2• 3 years ago

"My doctor scoffed at 23andme finding a dangerous genetic mutation and said its probably just a false positive."

They shouldn't scoff at it, but getting a proper test before any treatment or major changes is still the right thing.

dekhn9• 3 years ago

When I decided to have my genome sequenced, I went with Illumina's Understand Your Genome. This was a project they had to basically get rich execs to have their genome sequenced, learn their risks, and then invest in VCs investing in genomic startups (although it was just marketed as a product, Illumina had a larger goal).

I had my blood taken and a whole genome sequence- a 50GB file of reads off the machine, along with variant call files that should show how I differ from the reference genome, and another variant file that called out risky variants. You can download the files (https://my.pgp-hms.org/profile/hu80855C).

When you did UYG you'd go to this fancy spa in La Jolla and they give you an iPad with the files and you also talk to some genetic counselors.

I made a number of interesting observations when talking ot the counselors. The first is that they said they were confused by my report because it said I had absolutely no known risk variants (apoe, bcl, etc) and they had never seen that before. They also said, when they see some rare v ariants that they would just google for the variant and read random papers. What they said convinced me that genetic counselors, and genome tests in general, have limited applicability- there are a few genes where variants are clearly associated with negative disease outcomes, and the tests for those are very valuable (This is especially true for cancer, but other diseases as well) because they are clinically actionable.

But it also showed to me that counselors are making up garbage, because scanning the raw literature for variants and assuming that because a person has that variant they will be at risk, is not a good assumption. In my mind, the variations on polygenic risks scores have convinced me that we need to build large-scale (whole-genome) models of disease that use nonlinear functions trained on extremely large-scale datasets (like UKBB) to build up wholistic predictive models that do a better job of encapsulating the complexity of biology and its relation to disease, to the point where we can actually start making useful treatments and cures for a wide-range of genetically determined diseases.

pomatic• 3 years ago

Alerted by a friend who noticed his profile had changed, I checked mine. Going from having no French ancestry when first processed 5 years or so ago, I now have 12% French ancestry. That's a huge deal for me, because one of my parents was adopted. Hugely unimpressed at the lack of transparency (pro-active notification anyone?) and the overall accuracy - I don't trust these results anymore than the original, but the original did cause genuine distress.

pphysch4• 3 years ago

I'm surprised the health insurance industry isn't implicated here. Genome comparisons are a goldmine for creating risk models for individuals... I would even speculate that the whole thing was driven by insurance industry rather than pharma industry. "We're doing this for medicine!" looks like PR lipstick.

dekhn9• 3 years ago

Why would health insurance be implicated here? They're not allowed to use this sort of data due to GINA law.

justrealist4• 3 years ago

Well the ironic part is that their SNP array now would be fairly effective because genome imputation using 1k genomes etc has gotten so good. But now WGS is cheap enough that the value prop of using imputation is getting more and more marginal.

dekhn9• 3 years ago

it makes me so glad to hear that, because my first reaction (well over a decade ago) to people using arrays and imputation is: they data is there, why are you estimating it probabilistically (realistically, at the time, whole genomes cost too much, and scientists iwll always do short term probabilistic estimation to get an approximate answer quickly.

ravenstine2• 3 years ago

It's all about branding. They got in early and really got their name out there. Everyone has heard of 23 And Me. Off the top of my head, I can't think of another brand (though I know they exist), and people I know IRL still refer to 23 And Me.

vinniepukh• 3 years ago

Why did the CEO extract money from specifically Google and why did Google continue funding them despite all the shortcomings?

dekhn9• 3 years ago

The CEO, Anne Wojcicki, was married to Sergey Brin (founder of google): https://www.nytimes.com/2007/05/23/technology/23google.html Her sister Susan was also an exec at Google and provided space for the company when it first got started. Sergey loaned a bunch of money to 23&me before that, and his loan was repaid when google invested (which sounds like a conflict of interest to me, but then again, Sergey is a bunch of conflict of interests). Later, GV (Google Ventures) invested more in 23&Me. At the time, the head of GV was Bill Maris, who had worked with Anne before she founded her company (and I was an advisor for GV around that time; if they'd asked me, I would have said "don't put more money in this turkey").

So basically a little family of people who wanted to see the company succeed. I think they've been given their time to succeed and at best, have reached a sort of steady state where they are not going out of business, but also aren't achieving the interesting mission they were based on.

RadixDLT• 3 years ago

Currently, they are running advertisements claiming to offer the best DNA testing kits, but their approach is tarnishing the authenticity of articles.

slipperlobster2• 3 years ago

The testing kits may be the "best" - their data retention and security just sucks. I (stupidly) did 23andMe a while back, I've since requested my data to be deleted. Who knows if that's even honored.

dylan604• 3 years ago

I never trust that someone has deleted data. There is NO way of knowing that they did. Did they delete from the active database? What about clones of the data to DEV? What about back ups? I seriously doubt any company restores a back up to purge data only to make a new back up of that. If they did, do they purge the original back up and only use the new?

I don't care if something like GDPR states they must. I do not trust corps to actually go through the hassle/expense of it.

kijnh23uihUI3• 3 years ago

It's amusing how Google has shut down more services than Facebook, Microsoft, and Apple combined. Despite this, the controversial 23andme is somehow still operational. It seems like Sundar Pichai is doing everything in his power to dismantle Google.

Apocryphon• 3 years ago

23andMe is not an Alphabet company, whatever personal ties to Google royalty its founder might have.

justrealist4• 3 years ago

The firm claimed complainants had “negligently recycled” login credentials from other exposed accounts and that poor cyber hygiene practices were to blame for their exposure during the breach.

I mean. If people reused passwords for 23andMe, is this really 23andMe's fault? Should they have required 2FA for everything? That's kind of a hard sell tbh.

lambdaba2• 3 years ago

I agree with this. Frankly, if something is to blame, it's user agents / browsers that should be much better at educating and alerting about password reuse.

titzer• 3 years ago

during the breach.

Absurd that they thought that we'd miss this part of the sentence.

CodeWriter23• 3 years ago

Wrong question. Correct question: how does 23andMe know any customer used "password123" as a password?

lambdaba2• 3 years ago

I think one fair criticism is they could have had intrusion detection trigger when, presumably, the same IP address was logging in to thousands of accounts. But who knows how sophisticated the attack was?

[edit]: there are other obvious heuristics that could have detected it, it does show they had either very basic or no intrusion detection, which, for a service of this nature, isn't really acceptable

transcriptase• 3 years ago

Probably cross referenced their compromised customer account emails with a pastebin of email:pass pairs leaked from another hack.

bqmjjx0kac• 3 years ago

I don't think this is a smoking gun. Assuming competence, they could have obtained a password dump from another site that stored cleartext passwords, then compared their own database rows with hash(salt(leaked_password)).

ahahahahah• 3 years ago

It's easy and could be just how other companies with great security practices (like google) can tell you when they find your password in a password dump.

Imagine you are a company with great password practices, how would you tell that a user re-used a password that was exposed in some other data breach without you being able to generally know what a user's password is? Well, of course, it's the same way that you verify their password when they login. You track (or more likely in this case, adhoc check) data breaches, when you find a matched email in the breach with one of your users, you check if the password from the breach would allow that user to login.

maxrecursion• 3 years ago

So, to play devil's advocate, 23andMe shouldn't allow credential stuffing to happen by rate limiting logins after so many failed logins, or locking accounts after failed logins.

They could've blocked source IPs making all the login requests, but that was probably being changed to not set off alarms. However, there wasn't enough information in the article to go on, but since they suffered so many breaches of user accounts, they probably had to do something wrong. I'm too busy to dig into the specifics.

RajT88• 3 years ago

Not just rate limiting logins, but rate limiting queries against their user base (10k logins compromised, and data on ~6 million people scraped).

Additionally, they don't support 2FA/MFA which of course would mitigate some of the risk of password re-use.

There's plenty of things they could have done to prevent this breach.

adrianmonk• 3 years ago

Continuing devil's advocate, we don't know that they didn't do those things. Maybe they did and that's why it's only 14,000.

If an attacker works off lists of compromised usernames and passwords from various sites, for a given user there's always a chance that the first one they try is correct. Especially for the kind of user who recycles the exact same password on 50 different sites. (Incidentally, you should probably try to hack that kind of user first, and for each user, try their most-recycled passwords first.)

paxys• 3 years ago

Should they have required 2FA for everything?

If an average online gaming service or social network can manage sending 2FA codes over email or SMS when their users are logging in from a new device, the holder of a large chunk of the world's genetic data can as well.

intrasight• 3 years ago

Have they now fixed that?

rootusrootus• 3 years ago

If people reused passwords for 23andMe, is this really 23andMe's fault?

Yes absolutely. If it were one account being compromised due to the user reusing a password, that would be the user's fault. But what happened is credential stuffing, and that is absolutely something a professional IT organization should be prepared to defend against.

nerevarthelame• 3 years ago

It's all a balancing act between not wanting to unduly impact legitimate customers, while blocking as much fraud as possible.

Blocking the credential stuffing attacks? They probably did have mitigation efforts, but you can only be so aggressive before the false positives start blocking significant numbers of legitimate customers, who have no recourse except to wait out a temporary ban. And some credential stuffing attacks are extremely sophisticated, such that even best in class security companies can't always effectively block them.

Mandatory MFA? Great on paper, except that 10% of people hate the extra steps (probably with great overlap between the people reusing passwords) and will complain and/or disable it if given the chance. Another 20% have invalid or out of date contact details (an old employer's email address, a landline phone number that can't receive SMS, etc.), and they'll be locked out of their accounts.

Yeah, there are ways to mitigate these downsides. And I'm not arguing that 23andme found the appropriate balance between "customer satisfaction" and "customer security." But I can see how a mostly reasonable organization could end up in this position. And it's mainly the risk of terrible press and upset customers that allows other companies to justify more security-oriented policies, so let them have it.

randerson• 3 years ago

Every other healthcare website I use requires me to use enter a code texted or emailed to me the first time I log in from a new computer. If someone used a corporate email address for personal services, they're likely used to being locked out of things.

23andme is also unique in their ability to create security questions to authenticate users who get locked out. "What is your date of birth and can you form a sideways U shape with your tongue?"

woah• 3 years ago

Is there anywhere to get a DNA test anonymously? I assume maybe you could put false information into 23andMe, but I assume they'd still have your name from your credit card.

throwanem• 3 years ago

Well, I suppose it's nice we now have a canonical example of how not to do messaging around a successful credential stuffing attack...

crowcroft• 3 years ago

More likely this will prove to be another example of individuals under appreciating their personal data and privacy, and over appreciated some kind of novel technology.

beej71• 3 years ago

Sounds like if you don't require 2FA on your site and users are allowed to share data with one another on your site, you're now open for lawsuits.

23andMe tells victims it's their fault that their data was breached

Related Stories