Genetic testing firm 23andMe has confirmed that hackers gained access to the data of
over 7 million users, confirming the weird fact that people will do anything just to
find out that they’re 3% Scottish and that they have slightly higher than average
odds of hating the sound of chewing. I’m not joking, that’s directly from their website.
In China, the government has to secretly deploy a DNA database to track their citizens,
particularly ethnic minorities in regions like Xinjiang and Tibet - and the US is quick to warn
about the dangers of a government that will go to such lengths to track their population.
But they can do that because in the US, private companies like 23andMe collect this data for them
and as long as you frame it as a game where you can “find out what your DNA says about you and
your family,” people will actually pay money to hand over this very personal, identifiable data.
Today we’re going to take a quick look at how 23andMe was hacked - and you might be shocked
at just how easy it was - the dangers of these kinds of genetic testing kits and
what you can do to protect yourself, even if you’ve already taken one of these DNA tests.
The use of DNA has come a long way since it was first used back in 1986 to convict
a guy named Colin Pitchfork for murder. Despite having a name like pitchfork,
which seems like a clearcut sign of guilt, he almost got away with the
crime if he hadn’t boasted to coworkers about submitting a friend’s DNA instead of his own.
Fast forward almost 40 years, and the genealogy products and services market,
populated by companies like 23andMe, Ancestry.com, MyHeritage and others, is valued at over 3.5
billion dollars! And that’s only expected to grow despite this recent data breach.
What most people don’t realize, however, is that these DNA testing companies are treated
like regular consumer goods companies and not like healthcare providers,
meaning that they don’t have to follow the same HIPAA rules and regulations
related to how they collect, store and protect the consumer data given to them.
And that’s part of what has us in this most recent 23andMe mess. They took their data
security about as seriously as they do their marketing. Cilantro, really?
Check this out: the way that 23andMe was hacked is both mind blowingly simple and
ridiculously stupid. The hacker - or hackers, we don’t know - used a basic
technique known as credential stuffing to force their way into customer accounts.
It’s a technique where hackers take stolen user names and passwords found
in other data breaches and see if people used the exact same username and password
for their 23andMe account. And guess what? There were quite a few who did!
At least 14,000 according to what 23andMe disclosed in their SEC filing last week.
Think about it: this is like using the exact same key to open the door to your house,
start your car, lock your safe and enter your office. It may seem convenient,
but if one of those keys gets stolen, that person has access to everything you own.
And that’s the first lesson you can take from this whole ordeal: don’t reuse the same username
and password for all of your online accounts, even if the accounts don’t feel that important,
say, like a DNA testing website where your account holds your birth year,
zip code, ancestry reports and other, you know, mostly insignificant personal data.
And I know I’m poking fun at these DNA testing companies,
but I also recognize that there are legitimate reasons for genetic testing,
whether that’s finding out if you have a genetic condition that runs
in your family or even to diagnose that genetic condition or understand a good treatment plan.
The thing is, all of those legitimate reasons come from clinical genetic tests,
not the direct-to-consumer tests that 23andMe provides. Clinical
genetic tests are ordered by a doctor and the results are part of your confidential
medical profile that does have strict HIPAA privacy controls.
Not so for 23andMe. Not only are the results of these tests pretty pointless,
the companies are not regulated in how they handle and store the results of the tests. Now there is
a chance that might change after this recent data breach, with the government stepping in
to regulate the DNA testing industry - that’s a possibility - but that presents its own concerns.
Considering all of this, it seems pretty clear that taking one of these consumer DNA tests is
a pretty bad idea. Go ahead and scratch that off your Christmas list and if you’ve already
purchased one, just throw it away. It’s not even worth re-gifting it to your weird Uncle
Charlie because, as in the case of the 23andMe breach, it was because of linked family tree
relatives that the initial 14,000 hacked accounts turned into almost 7 million profiles accessed.
But what if you’re one of the millions of people who have already taken one of these
DNA tests? What can you do? According to the 23andMe website, you can request to
have your personal information deleted, both within your dashboard and by emailing them
directly. And I definitely advise you to take that step, although you should know that they
are “required to retain some information to comply with their legal obligations”.
In other words, do what you can - delete your profile on whatever DNA testing site
you used and email their privacy email for good measure - and then chalk this
up to a learning experience. Next time make sure you create unique passwords for your
accounts - perhaps use a password manager - and when somebody tries to sell you a product
that requires you to hand over any kind of personal data, particularly biometric data,
and to PAY money to do so! - just politely tell them you’re fine not knowing about your
Scottish roots and you already prefer not listening to the sound of chewing.