Ashkenazi Jews have been targeted in a Cyberattack, according to the reports malicious actors are advertising the sale of data sets containing names, addresses, and ethnic backgrounds of potentially millions of customers from the genetic testing firm 23andMe. They initially highlighted a batch that specifically includes information about individuals with Jewish heritage.
On hacker forums, a snippet of the breached data was shared, particularly on a website where the perpetrators asserted that the sample encompassed 1 million data entries pertaining to Ashkenazi Jewish individuals.
Additionally, as per Wired's report, on Wednesday, the malicious group put up data profiles for sale, pricing them between $1 and $10 per account. The sample allegedly contains entries for prominent tech figures such as Mark Zuckerberg and Elon Musk.
However, the authenticity of these entries remains uncertain.
While an inquiry into the data's authenticity is underway, the disclosed information aligns with an internal company scenario. This situation involved certain accounts being compromised, which in turn facilitated unauthorized access to additional data via 23andMe's DNA Relatives feature.
The customer profile details were obtained by gaining entry into individual accounts, but it's important to note that the company's overall security was not compromised. The compromised data does not seem to encompass the raw genetic data that the company processes. Instead, it comprises particulars such as gender, birth year, genetic lineage findings, and geographical ancestry information.
“We do not have any indication at this time that there has been a data security incident within our systems, rather, the preliminary results of this investigation suggest that the login credentials used in these access attempts may have been gathered by a threat actor from data leaked during incidents involving other online platforms where users have recycled login credentials,” a spokesperson from 23andMe reported to Forbes.
DNA testing companies like 23andMe have come under scrutiny from privacy advocates and regulators due to concerns about handling sensitive genetic data. A privacy specialist from Stanford University pointed out in 2021 that a critical question revolves around where genetic data is being sent and why various companies and investors have a financial interest in it.
23andMe, having gone public via a Richard Branson SPAC two years ago, provides consumers with both ancestral information and health advice. This includes personalized dietary recommendations and insights into potential genetic predispositions to diseases or conditions. The company consistently emphasizes that user data is only shared externally through opt-in agreements and, when shared, is meticulously anonymized for privacy protection.
What could be the future cybersecurity risks associated with sharing sensitive genetic data:
1. Cybersecurity Breaches: Despite robust security measures, there is an ongoing risk of cyber-attacks that could compromise the confidentiality and integrity of genetic data.
2. Data Exploitation for Identity Theft: Stolen genetic data could potentially be used in sophisticated identity theft schemes, undermining personal security measures.
3. Targeted Cyber Threats: Individuals with identifiable genetic markers may become targets for cyber threats, including phishing attempts or social engineering attacks.
4. Ransomware and Extortion: Cybercriminals may use sensitive genetic data as leverage for extortion, demanding payments or other concessions in exchange for not disclosing or misusing the information.
5. Biometric Authentication Risks: As genetic data plays a role in biometric authentication, unauthorized access to this information poses a direct threat to security measures relying on biometric factors.
6. Healthcare Data Integration Risks: The integration of genetic data with electronic health records introduces new attack vectors, potentially leading to unauthorized access or manipulation of health-related information.
7. Distributed Denial-of-Service (DDoS) Attacks: Genetic testing companies and associated platforms may become targets of DDoS attacks, disrupting services and compromising data availability.
8. Third-party Vendor Vulnerabilities: If genetic data is shared with third-party vendors, their cybersecurity practices and vulnerabilities could directly impact the security of the data.
9. Pharming Attacks: Cybercriminals might create fake websites or services claiming to offer genetic testing, leading individuals to unknowingly disclose sensitive information.
10. Social Engineering Exploits: Cybercriminals may use information from genetic data to craft convincing social engineering attacks, aiming to deceive individuals into revealing further personal or financial details.
It is imperative for individuals to exercise caution and seek services from reputable, well-secured platforms when dealing with genetic data. Additionally, organizations handling genetic information should prioritize robust cybersecurity measures to protect against these potential risks.
