A threat actor allegedly published 4.1 million genetic data profiles stolen from the DNA testing company 23andMe in dark web forums.
The British Royal Family, wealthy families that support Zionism, and the wealthiest individuals in the United States and Western Europe are among those whose information was disclosed.
The genetic profiles of 23andMe were published on Tuesday by a hacker going by the name Golem on the well-known cybercrime forum BreachForums.
After learning of the breach, the company contacted its customers and reminded them to take extra precautions to keep their accounts and passwords safe.
Hackers Using Credential Stuffing Attack
On October 6, 23andMe revealed that hackers had gained access to some user data. The company claimed that the hackers had used credential stuffing, a technique where they tried combinations of usernames or emails and corresponding passwords that were already known as a result of other data breaches, to gather the stolen data.
Implementing AI-Powered Email security solutions “Trustifi” can secure your business from today’s most dangerous email threats, such as Email Tracking, Blocking, Modifying, Phishing, Account Take Over, Business Email Compromise, Malware & Ransomware
The company said that when customers reused login information, that is when usernames and passwords used on 23andMe were the same as those used on other websites that had previously been hacked—threat actors were able to access specific accounts.
“Threat actor may have then, in violation of our Terms of Service, accessed 23andMe.com accounts without authorization and obtained information from certain accounts, including information about users’ DNA Relatives profiles, to the extent a user opted into that service”, the company said.
The hacker publishing the stolen information, Golem, seems to have first tried to sell the user details. On Wednesday, he stated: “I would like to remind you that even the data I’m sharing here is extremely valuable.”
On August 11, a hacker posted an advertisement on the Hydra forum for a set of 23andMe user data. According to a TechCrunch study, that collection of user data matched some of the user details exposed two weeks prior.
The hacker stated having 300 gigabytes of 23andMe customer data on Hydra, although the hacker offered no support for this claim.
Hence, the company advised customers to take additional precautions to keep their accounts and passwords safe and stated that they were seeking the help of third-party forensic experts and federal law enforcement officials.
The company requires all customers to change their passwords, and they encourage the usage of multi-factor authentication (MFA).
Protect yourself from vulnerabilities using Patch Manager Plus to patch over 850 third-party applications quickly. Take advantage of the free trial to ensure 100% security.