Biotech company and genetic testing provider 23andMe is facing multiple lawsuits from customers over a cyberattack that occurred in October that led to a data breach. In order to address the situation, 23andMe has amended its Terms of Service to make it harder for customers to sue the company.
In October, cybercriminals tried to sell 23andMe customer data but failed, resulting in the leak of data on 1 million Ashkenazi Jews and 4.1 million people living in the United Kingdom.
According to BleepingComputer, the attackers obtained the data through credential stuffing attacks that allowed them to compromise accounts . Using this limited number of accounts, the threat actors used the “DNA Relatives” feature to steal the data of millions of people.
See also: Austal USA: Data breach by Hunters International?
23andMe recently told BleepingComputer that a total of by the breach.affected data (5.5 million through the DNA Relatives feature and 1.4 million people through the Family Tree feature)
The company's Terms of Use were changed to avoid lawsuits
The data breach led to numerous lawsuits against the company, which is why 23andMe decided to update Terms of Service on November 30th to include a provision stating that mandatory arbitration is required for all disputes, instead of jury trials or class actions.
“These Terms of Service contain a mandatory arbitration provision that requires the use of arbitration on an individual basis to resolve disputes in certain circumstances, instead of jury trials or class actions,” the updated Terms of Service states.
The changed terms were sent via email to customers, and it states that users have up to 30 days, from receiving the notification, to inform 23andMe at customercare@23andme.com that they disagree with the new terms.
See also: Dollar Tree: Data breach affects 2 million people
Those who send an email disputing the update will remain under the previous Terms of Service.
Nancy Kim, a law professor at Chicago-Kent College of Law, reportedly told Axios that this change to the Terms of Service likely won't protect 23andMe from lawsuits.
A key element of a data breach claim is proof that a data breach has actually occurred. This usually involves proving that personal information or other sensitive data has been leaked or illegally accessed. In this case, the breach has been confirmed.
See also: DP World: Cyberattack led to data breach
Typically, lawsuits against companies that have suffered a data involve determining the damages required to repair the damage caused by the incident.
Source: www.bleepingcomputer.com
