The identical hacker who leaked a trove of person knowledge stolen from the genetic testing firm 23andMe two weeks in the past has now leaked thousands and thousands of latest person information.
On Tuesday, a hacker who goes by Golem printed a brand new dataset of 23andMe person info containing information of 4 million customers on the recognized cybercrime discussion board BreachForums. TechCrunch has discovered that a few of the newly leaked stolen knowledge matches recognized and public 23andMe person and genetic info.
Golem claimed the dataset incorporates info on individuals who come from Nice Britain, together with knowledge from “the wealthiest individuals dwelling within the U.S. and Western Europe on this record.”
23andMe spokespeople didn’t instantly reply to a request for remark.
On October 6, 23andMe introduced that hackers had obtained some person knowledge, claiming that to amass the stolen knowledge the hackers used credential stuffing — a standard approach the place hackers attempt combos of usernames or emails and corresponding passwords which might be already public from different knowledge breaches.
Contact Us
Do you will have extra details about the 23andMe incident? We’d love to listen to from you. You’ll be able to contact Lorenzo Franceschi-Bicchierai securely on Sign at +1 917 257 1382, or by way of Telegram, Keybase, and Wire @lorenzofb, or electronic mail lorenzo@techcrunch.com. You can even contact TechCrunch by way of SecureDrop.
In response to the incident, 23andMe prompted customers to vary their passwords and inspired switching on multi-factor authentication. On its official web page addressing the incident, 23andMe mentioned it has launched an investigation with assist from “third-party forensic consultants.” 23andMe blamed the incident on its clients for reusing passwords, and an opt-in characteristic known as DNA Kinfolk, which permits customers to see the info of different opted-in customers whose genetic knowledge matches theirs. If a person had this characteristic turned on, in concept it might permit hackers to scrape knowledge on a couple of person by breaking right into a single person’s account.
There are nonetheless a variety of unanswered questions on this incident. It’s not recognized if the hackers truly used credential stuffing and never one other approach to steal the info, how a lot person knowledge was stolen, and what the hackers intend to do with it.
The incident seems to have been performed, or a minimum of launched, a number of months in the past. On August 11, a hacker on one other cybercrime discussion board known as Hydra marketed a set of 23andMe person knowledge. That set of person knowledge matched a few of the person information leaked two weeks in the past, in accordance with a TechCrunch evaluation.
On Hydra, the hacker claimed to have 300 terabytes of 23andMe person knowledge, although the hacker didn’t present any proof for this declare.
Whatever the many unanswered questions, what’s clear is that we nonetheless don’t know the complete extent of this knowledge leak. And it’s not clear that 23andMe is aware of but how a lot knowledge was taken.