Genomics company 23andMe confirmed Friday that a sample containing 1 million user data points was stolen and listed for sale, Forbes reported.
The data sample from the attack was reportedly posted on hacker forums, with one website claiming the sample contained 1 million data points specifically targeting Ashkenazi Jews. The stolen data profiles were offered for sale Wednesday, with prices ranging from $1 to $10 per account. Notably, entries for tech billionaires Mark Zuckerberg and Elon Musk were included in the sample, although the authenticity of these entries remained unconfirmed as of Saturday, according to Forbes.
The attackers reportedly utilized recycled password attacks to guess login information of a subset of users. They then accessed additional data through a feature which allows users to share information with others, the outlet noted.
23andMe User Data Stolen And Listed For Sale In Attack Targeting Ashkenazi Jewshttps://t.co/d84TiN15gB pic.twitter.com/O1UvmgaGM8
— Forbes (@Forbes) October 7, 2023
The leaked data aligns with an internal company situation where some accounts were exposed, leading to further data access through 23andMe’s DNA Relatives feature. While individual customer profiles were accessed, the company itself was not breached. The stolen data does not include raw genetic data but comprises information such as sex, birth year, genetic ancestry results and geographic ancestry information, per Forbes. (RELATED: UK Announces Massive Voter Data Breach)
“We do not have any indication at this time that there has been a data security incident within our systems. The login credentials used in these access attempts may have been gathered by a threat actor from data leaked during incidents involving other online platforms where users have recycled login credentials,” a spokesperson for 23andMe told Forbes.