23andme Confirms Hackers Stole Ancestry Data On 6 9 Million Users

On Friday, genetic testing company 23andMe announced that hackers accessed the personal data of 0.1% of customers, or 14,000 individuals . The company also said that by accessing those accounts, hackers were also able to access “a significant number of files containing profile information other users’ ancestry.” But 23andMe would not say how many “other users” were impacted by the breach that the company initially disclosed in early October .

As it turns out, there were a lot of “other users” who were victims of this data breach: 6.9 million affected individuals in total.

In an email sent to TechCrunch late on Saturday, 23andMe spokesperson Katie Watson confirmed that hackers accessed the personal information of 5.5 million people who opted-in to 23andMe’s DNA Relatives feature, which allows customers to automatically some of their data with others. The stolen data included the person’s name, birth year, relationship labels, the percentage of DNA shared with relatives, ancestry reports and self-reported location.

23andMe also confirmed that another group of 1.4 million people who opted-in to DNA Relatives also “had their Family Tree profile information accessed,” which includes display names, relationship labels, birth year, self-reported location and whether the user decided to their information, the spokesperson said. (23andMe declared part of its email as “on background,” which requires that both parties agree to the terms in advance. TechCrunch is printing the as we were given no opportunity to reject the terms.)

It is also not known why 23andMe did not these numbers in its disclosure on Friday.

Considering the new numbers, in reality, the data breach is known to affect roughly half of 23andMe’s total reported 14 million customers.

In early October, a hacker claimed to have stolen the DNA information of 23andMe users in a post on a well-known hacking forum. As proof of the breach, the hacker published the alleged data of one million users of Jewish Ashkenazi descent and 100,000 Chinese users, asking would-be buyers for $1 to $10 for the data per individual account. Two weeks later, the same hacker advertised the alleged records of another four million people on the same hacking forum.

When we analyzed the months-old leaked data, TechCrunch found that some records matched genetic data published online by hobbyists and genealogists. The two sets of information were formatted differently, but contained some of the same unique user and generic data, suggesting the data leaked by the hacker was at least in part authentic 23andMe customer data.

In disclosing the incident in October , 23andMe said the data breach was caused by customers reusing passwords, which allowed hackers to brute-force the victims’ accounts by using publicly known passwords released in other companies’ data breaches.

Because of the way that the DNA Relatives feature matches users with their relatives, by hacking into one individual account, the hackers were able to see the personal data of both the account holder as well as their relatives, which magnified the total number of 23andMe victims.