The company clarified that the discrepancy in the number of affected users is due to the fact that the 14,000 breached accounts unlocked information about exponentially more users. The hack was a credential-stuffing attack, where hackers used leaked usernames and passwords. 23andMe has since forced all users to change their passwords and stated that there is no indication of a breach within their systems.
Key takeaways:
- 23andMe, a leading consumer DNA harvesting company, announced that hackers stole data from about 14,000 users, but the actual number of affected users is around 6.9 million.
- The stolen data includes users' genetic information, names, birth years, relationship labels, DNA shared with relatives, ancestry reports, and location.
- The discrepancy in the number of affected users is due to the fact that the DNA Relatives feature, which was opted into by many users, allowed the hackers to access data about other users as well.
- The company confirmed that the hack was a credential-stuffing attack, where hackers used leaked usernames and passwords to break into individual accounts. Following the attack, 23andMe forced all of its users to change their passwords.