141
submitted 11 months ago* (last edited 11 months ago) by jeffw@lemmy.world to c/news@lemmy.world

A hacker is offering to sell records identifying names, locations and ethnicities of potentially millions of customers of genetic testing company 23andMe, beginning by touting a batch that would contain data of those with Jewish ancestry.

A 23andMe spokeswoman confirmed that the leak contained samples of genuine data and said the company is investigating. She said it appeared likely that the hacker or accomplices used a common technique called credential stuffing: Taking username-and-password combinations published or sold after breaches at other companies, and trying those combinations to see which were reused by 23andMe customers. When the hacker found logins that worked, they copied all the information made available to legitimate users by their relatives, sometimes hundreds of them per account.

The company said it had reported the matter to law enforcement and that this was the first incident of its kind at the firm.

The data does not include genomic details, which are especially sensitive, but does include usernames, regional locations, profile photos, and birth years. The usernames are often something other than full legal names.

23andMe said it was encouraging users to change their passwords and use two-factor authentication to prevent others from logging in under their name. Online posts offering the data for sale in underground forums said buyers could acquire 100 profiles for $1,000 or as many as 100,000 for $100,000. One post said the person had uploaded a large database of Ashkenazi Jews. The company spokeswoman said that would include people with even 1% Jewish ancestry.

Some of the posts used the handle “Golem,” a reference to a humanoid beast in Jewish folk tales.

The data taken from 23andMe could cover more than half of the company’s 14 million customers, based on the number of people who have opted to make their data visible to relatives, including distant cousins.

While the reference to Jews might have been designed to draw attention and increase the odds of transactions, it comes during a time of increased rhetorical and physical attacks on Jews in the United States. Antisemitism has gotten more traction in the past year on social networks for conspiracy theories that blame Jews for illegal immigration, media manipulation or financial misdeeds.

top 16 comments
sorted by: hot top controversial new old
[-] ubermeisters@lemmy.world 13 points 11 months ago

People need to get some fucking chill

[-] FlyingSquid@lemmy.world 4 points 11 months ago

As someone of almost entirely Ashkenazi heritage, all I can say is I'm glad I never used 23andMe, but I'm scared for a lot of my fellows.

[-] jeffw@lemmy.world 7 points 11 months ago

As someone who is 50% Ashkenazi and on 23andMe, I’m not super happy

[-] elevenfingerfrk@lemm.ee 2 points 11 months ago

My partner is Jewish and used the service to learn more about her ancestry. This sucks.

Is it just me or does it seem it’s a really bad idea to buy into any product that involves accumulating PII? I’m old enough to have noticed that in nearly every instance that data is either misused, stolen, or used as intended for a really shitty purpose.

this post was submitted on 07 Oct 2023
141 points (98.0% liked)

News

22831 readers
4165 users here now

Welcome to the News community!

Rules:

1. Be civil


Attack the argument, not the person. No racism/sexism/bigotry. Good faith argumentation only. This includes accusing another user of being a bot or paid actor. Trolling is uncivil and is grounds for removal and/or a community ban.


2. All posts should contain a source (url) that is as reliable and unbiased as possible and must only contain one link.


Obvious right or left wing sources will be removed at the mods discretion. We have an actively updated blocklist, which you can see here: https://lemmy.world/post/2246130 if you feel like any website is missing, contact the mods. Supporting links can be added in comments or posted seperately but not to the post body.


3. No bots, spam or self-promotion.


Only approved bots, which follow the guidelines for bots set by the instance, are allowed.


4. Post titles should be the same as the article used as source.


Posts which titles don’t match the source won’t be removed, but the autoMod will notify you, and if your title misrepresents the original article, the post will be deleted. If the site changed their headline, the bot might still contact you, just ignore it, we won’t delete your post.


5. Only recent news is allowed.


Posts must be news from the most recent 30 days.


6. All posts must be news articles.


No opinion pieces, Listicles, editorials or celebrity gossip is allowed. All posts will be judged on a case-by-case basis.


7. No duplicate posts.


If a source you used was already posted by someone else, the autoMod will leave a message. Please remove your post if the autoMod is correct. If the post that matches your post is very old, we refer you to rule 5.


8. Misinformation is prohibited.


Misinformation / propaganda is strictly prohibited. Any comment or post containing or linking to misinformation will be removed. If you feel that your post has been removed in error, credible sources must be provided.


9. No link shorteners.


The auto mod will contact you if a link shortener is detected, please delete your post if they are right.


10. Don't copy entire article in your post body


For copyright reasons, you are not allowed to copy an entire article into your post body. This is an instance wide rule, that is strictly enforced in this community.

founded 1 year ago
MODERATORS