Data On 23andMe Users Leaks To Dark Web, One Million Data Disbanded

The site 23andMe was hacked by hackers. (photo: twitter @23andme)

JAKARTA - On Thursday, October 5, 23andMe announced via blog that data from users of its genetic test platform and analysis had been circulating on the dark web forum after hackers used logins that had previously been used to access these accounts.

BleepingComputer reports that a hacker has uploaded about "1 million lines of data" which they claim came from Ashkenazi Jewish people before announcing that they will sell stolen 23andMe data for 1 to 10 US dollars per account. The data includes usernames, profile photos, genetic descent results, date of birth, and geographical location of users.

The company confirmed the authenticity of the data to BleepingComputer in a statement also shared via email to The Verge. In the statement, Managing Editor 23andMe, Scott Hadly, wrote that "initial results from this investigation suggest that the login credentials used in this access effort may have been obtained by threat actors from leaked data during incidents involving other online platforms where users have reused login credentials."

He added that there is no indication of "security incident within our system." BleepingComputer reported that other user data was taken using 23andMe's 'DNA Relatives' feature which is the user's option.

The 23andMe blog post provides a link to a hint for resetting passwords and setting multi-factor authentication. The company also includes a link to a privacy and security check page and says that users who need help can email a support team.

According to a PCMag report on Wednesday, as many as 7 million accounts may be sold, citing a post from Dark Web Information sharing screenshots of a now-deleted hacker forum post. That number is about half of the total users on the 23andMe platform. According to ArsTechnica, hackers claimed that CEO 23andMe knew about the data leaked two months earlier, but did not disclose the incident.