(pbs.twimg.com/media/F7x02TMWwAAcXwq?format=jpg&name=medium) Genetics firm 23andMe confirms user data theft in a credential stuffing attack.

✡️ The hackers released 1 million lines of data targeting Ashkenazi Jews.

23andMe, a renowned U.S. biotech & genomics firm, offers genetic testing services.

A threat actor recently leaked data samples from the firm and is now selling 23andMe customer data packs.

The initial data leak was limited but deeply concerning.
The threat actor released 1 million lines of data specifically for Ashkenazi people.

This targeted attack raises serious questions about the motive behind the breach.

On October 4, the hacker offered to sell data profiles in bulk, ranging from $1-$10 per 23andMe account, depending on the quantity purchased.

23andMe's RESPONSE: The company confirmed the data's legitimacy. They believe the hackers used credentials from other breaches to access 23andMe accounts.

"We do not have any indication at this time that there has been a data security incident within our systems."

The leaked data includes full names, usernames, profile photos, sex, date of birth, genetic ancestry results, and geographical location.

This is a goldmine for identity thieves and malicious actors.

The compromised accounts had opted into the platform's 'DNA Relatives' feature.

The hacker accessed a few 23andMe accounts and scraped the data of their DNA Relative matches, showing the potential risks of such features.

23andMe offers two-factor authentication and urges all users to enable it.

It's a reminder for everyone to refrain from reusing passwords and to always use strong, unique credentials.

threadreaderapp.com/thread/1710370423311888724.html

bleepingcomputer.com/news/security/genetics-firm-23andme-says-user-data-stolen-in-credential-stuffing-attack/

https://i.poastcdn.org/d0e707c3311f8a0687ee1df2a2ae631e36de1d6b7e54f42b678a089071367059.png