23andMe Genetic Data Allegedly Offered for Sale and Shared Online
Summary
Dark-web sellers and forum users claimed to offer and share 23andMe data, including personal and genetic details. 23andMe said the data was obtained through credential stuffing and reported no evidence of a breach of its IT systems.
Key points
- A seller claimed in August 2023 to have 10 million records and offered the data for sale; the claim and volume were not independently established in the article.
- The article says later forum and Telegram posts shared claimed subsets, including data associated with people in the UK, Germany and China.
- The purported data included names, birth years, locations, DNA markers and ancestry-related information.
- 23andMe said the data was obtained through credential stuffing and that it found no evidence of a security breach on its IT systems.
- The article warns that exposure of ancestry and genetic information could put affected individuals, particularly public figures, at risk.
- Some users reportedly framed their sharing of the data as a response to the Israel-Gaza conflict.
Article Details
- Victim Organization
- 23andMe
- Incident Type
- Reported credential-stuffing attack associated with exposure and circulation of customer data; 23andMe said there was no evidence of a breach of its IT systems.
- Disclosure Date
- 2023-10-20
- Data Types Exposed
- Full names
- Year of birth
- Location
- DNA markers
- Ancestry-related information
- Affected Records
- A seller claimed to have 10 million records; another post claimed to contain information on 1 million Ashkenazi Jews. These quantities were not independently confirmed in the article.
- Affected Data Size
- A seller claimed the file was over 300 TB; this was not independently confirmed.
- Operational Impact
- No operational disruption was reported. 23andMe said there was no evidence of a security breach on its IT systems.
- Ransom Or Extortion
- A marketplace seller claimed to offer the data for $50 million, or parts at $10,000 per 1,000 records, and later claimed the full data had been sold. These were seller claims; the article does not confirm a sale or ransom demand to 23andMe.
- Claim Status
- claimed