6.9 million customers of 23andMe had non-public data stolen by way of hackers

An estimated 6.9 million customers of the genetic trying out corporate 23andMe had their non-public data stolen by way of hackers in a up to date knowledge breach, an organization spokesperson showed to The Hill on Monday.

A spokesperson for 23andMe informed The Hill an estimated 5.5 million customers had their knowledge accessed from the corporate’s DNA Family members function, which is helping customers to find and hook up with circle of relatives kin who even have the function enabled.

Hackers additionally breached the knowledge of an extra 1.4 million other folks’s circle of relatives tree profiles, which incorporates numerous figuring out details about the consumer, the spokesperson mentioned.

TechCrunch first reported the estimated 6.9 million customers impacted within the breach.

23andMe first introduced the knowledge breach in early October and mentioned each third-party forensic professionals and federal police officers had been aiding within the investigation.

Remaining Friday, the corporate mentioned the investigation used to be whole, and filed findings with the U.S. Securities and Alternate Fee.

Within the findings, the corporate mentioned hackers had been in a position to get right of entry to 0.1 p.c of the corporate’s consumer knowledge, which the corporate known as a “very small proportion.” The spokesperson showed Monday this equals about 14,000 customers.

Hackers had been in a position to get right of entry to accounts in cases the place usernames and passwords that had been used at the 23andMe web site matched the ones used on different web sites that had been in the past compromised, in step with the spokesperson.

The spokesperson added the hackers used this knowledge to get right of entry to the DNA Family members profile recordsdata and Circle of relatives Tree profile data.

“We wouldn’t have any indication that there was a breach or knowledge safety incident inside of our techniques, or that 23andMe used to be the supply of the account credentials utilized in those assaults,” the spokesperson famous.

The corporate closing Friday mentioned it has “taken steps” to offer protection to consumer knowledge, together with asking present shoppers to reset their password and implementing a two-step verification way for each new and present customers.

Following 23andMe’s preliminary announcement of the knowledge breach in October, Connecticut State Lawyer Common William Tong asked more information at the incident, which he alleged centered the knowledge of people with Ashkenazi Jewish and Chinese language heritage.

Tong claimed the hack resulted in the sale of a minimum of a million knowledge profiles with Ashkenazi Jewish heritage at the unlawful marketplace and that some other leak uncovered knowledge associated with masses of 1000’s of other folks with Chinese language ancestry.

On the time, a 23andMe spokesperson informed The Hill its investigation instructed “risk actors had been in a position to get right of entry to sure accounts in cases the place customers recycled login credentials.”

The Hill reached out the Connecticut state lawyer common’s place of work and 23andMe for an replace on Tong’s inquiry.