Security News > 2024 > January > 23andMe data breach: Hackers stole raw genotype data, health reports

Genetic testing provider 23andMe confirmed that hackers stole health reports and raw genotype data of customers affected by a credential stuffing attack that went unnoticed for five months, from April 29 to September 27.

The credentials used by the attackers to breach the customers' accounts were stolen in other data breaches or used on previously compromised online platforms.

As the genomics and biotechnology company disclosed in data breach notification letters sent to those impacted in the incident, some of the stolen data was posted on the BreachForums hacking forum and the unofficial 23andMe subreddit site.

"Our investigation determined the threat actor downloaded or accessed your uninterrupted raw genotype data, and may have accessed other sensitive information in your account, such as certain health reports derived from the processing of your genetic information, including health-predisposition reports, wellness reports, and carrier status reports," 23andMe revealed.

23andMe told BleepingComputer in December that the hackers downloaded the data of 6.9 million people of the existing 14 million customers after breaching around 14,000 user accounts.

23andMe updates user agreement to prevent data breach lawsuits.

News URL

https://www.bleepingcomputer.com/news/security/23andme-data-breach-hackers-stole-raw-genotype-data-health-reports/