Hackers gained access to nearly seven million 23andMe, according to the genetic testing company.
The breach includes, among other things, the disclosure of personal information such as users' origins, zip codes, and dates of birth.
See also: Hacking group from North Korea steals data
A report filed Friday by 23andMe with the Securities and Exchange Commission said that about 0.1% of the company's users, or about 14,000 people, had their accounts compromised in a hacking attack.
23andMe says it is providing support for that number, but it told reporters that the hackers were able to gain access to about 5.5 million profiles using a company feature called “DNA Relatives,” which allows users to identify genetic relatives. In addition, the hackers had access to a subset of family tree information on 1.4 million DNA relative profiles, according to a statement from a 23andMe spokesperson.
This is the latest hacking attack to affect a major US company, and it has affected many more people than initially reported. Last month, identity management company Okta admitted that hackers managed to steal data from all users in its customer support system Okta, despite initially saying that only 1% of more than 18,000 were affected.
In the case of 23andMe, hackers used old usernames and passwords from other websites to gain unauthorized access to 23andMe customer accounts. This technique, known as “credential stuffing,” while simple, proved effective.
The 23andMe spokesperson, who remained anonymous, declined to answer questions about who committed the breach.
23andMe has completed its investigation, working with forensic experts. Affected customers have now been notified, as required by law.
Read more: DePauw University: Warns of data breach
We have taken measures to further protect our customers, including requiring passwords to be changed for all existing customers and implementing two-factor authentication for new and existing customers.
Source: edition.cnn.com
