Genetic testing firm 23andMe investigated over hack that hit 7m customers

The California genetic testing firm 23andMe faces investigations by the information watchdogs of the UK and Canada over a security breach affecting practically 7 million individuals final October.

Hackers who broke into the location gained entry to private data through the use of prospects’ previous passwords. In some instances the knowledge accessed included household bushes, beginning years and geographic areas.

The San Francisco-based firm analyses its prospects’ DNA via a saliva pattern to supply insights into well being and ancestry, and has bought greater than 12m DNA testing kits because it was arrange in 2006, according to its website.

The UK’s Info Commissioner’s Workplace (ICO) and the Workplace of the Privateness Commissioner of Canada (OPC) have launched a joint investigation into the information breach, the ICO mentioned.

It’ll study the scope of data that was uncovered by the breach and potential harms to affected individuals; whether or not 23andMe had satisfactory safeguards to guard the extremely delicate data inside its management; and whether or not the corporate supplied satisfactory notification concerning the breach to the 2 regulators and affected individuals, as required below Canadian and UK knowledge safety legal guidelines.

“We intend to cooperate with these regulators’ cheap requests,” 23andMe mentioned in an announcement.

A 23andMe spokesperson beforehand instructed the Guardian that the corporate did not “detect a breach” inside 23andMe programs and as a substitute attributed the incident to compromised recycled login credentials from sure customers.

Hackers initially accessed the private knowledge of 0.1% of consumers – or about 14,000 individuals, which enabled them to entry different individuals’s data due to an opt-in function that enables DNA-related kinfolk to contact one another, so the true variety of individuals uncovered was 6.9 million. This was simply lower than half of 23andMe’s 14 million reported prospects.

23andMe sells DNA testing kits ranging from £79 for an “ancestry service” – “be taught extra about who you’re” – and £129 for a “well being and ancestry service” – “higher perceive how genetics impression your well being”.

The UK data commissioner, John Edwards, and the privateness commissioner of Canada, Philippe Dufresne, will examine the 23andMe breach collectively.

Edwards mentioned: “Individuals must belief that any organisation dealing with their most delicate private data has the suitable safety and safeguards in place. This knowledge breach had a world impression, and we sit up for collaborating with our Canadian counterparts to make sure the private data of individuals within the UK is protected.”

Dufresne mentioned: “Within the improper arms, a person’s genetic data might be misused for surveillance or discrimination. Making certain that non-public data is satisfactorily protected in opposition to assaults by malicious actors is a vital focus for privateness authorities in Canada and all over the world.”