23andMe agrees to settle over 2023 data breach
By: Mary Walrath-Holdridge
USA Today
..... Ancestry and genetics-testing company 23andMe has agreed to pay a 430 million settlement after a class-action lawsuit was brought against the company for last year's [2023] data breach.
.....
The settlement, which is pending a judge's approval, comes after the company confirmed last October [2023] that "threat actors" used about 14,000 accounts, approximately 0.1% of the company's user base, to access the ancestry data of 6.9 million connected profiles. Leaked data included suers' account information, location, ancestry reports, DNA matches, family names, profile pictures, birth dates and other information.
..... While 23andMe confirmed the existence of the breach in October, [2023] it did not reveal the full extent of the issue until December. [2023] A class-action suit was filed in San Francisco the following month, [01/2024] accusing 23andMe of failure to amply protect users' personal information. It also accused 23andMe of neglecting to notify certain users that data form people with Chinese or Ashkenazi Jewish heritage appeared to be targeted in the breach.
..... Terms of the settlement include paying to those affected by the security incident to cover expenses like those incurred fighting identity theft, installing physical security systems or seeking mental health treatment; payments to those living in states with genetic privacy laws; payments to all those who had health information leaked; and three years of access to state of the art Privacy & Medical Shield + Genetic Monitoring" for all settlement members who enroll.
..... The company admitted to no wrongdoing as part of the agreement to pay $30 million to affected parties.
..... A judge still has to approve the deal. If approved, more information will be released for affected parties looking to get in on the legal action.
..... In October, [2023] 23andMe said via its website that an outside entity had stolen information from customers using its DNA Relatives feature. The company temporarily disabled the service, saying it believed "threat actors" had gained access using a technique called credential stuffing, in which they used usenames and passwords that had already been exposed via other websites; data breachers or otherwise became available.
.....
"We believe threat actors were able to access certain accounts in instances where uses recycled login credentials - that is, usernames and passwords that were used on 23andMe.com were the same as those used on other websites that have been previously hacked,: 23andMe wrote on its website at the time.
..... In December, [2023] 23andMe revealed the extent of the breach, saying ancestry data of 6.9 million people had been affected, 5.5 million of whom were suers who opted into 23andMe's DNA Relatives feature, which linked people with common DNA. Another 1.4 million users also had their family tree information accessed.
..... The accessed data contained personal and family information, according to the company.
.....
Family tree information exposed in the breach includes: display name, relationship labels, birth year and self-reported locations (city, zip code).
..... Contributing: Amaris Encinas and James Powel, USA Today