23&Me breach targets Jews

[Rachel Rugelach]

"Hackers have compiled a giant apparent list of people with Ashkenazi Jewish ancestry after taking that information from the genetic testing service 23andMe, which is now being shared on the internet.

"A database that has been shared on dark web forums and viewed by NBC News has a list of 999,999 people who allegedly have used the service. It includes their first and last name, sex, and 23andMe’s evaluation of where their ancestors came from. The database is titled “ashkenazi DNA Data of Celebrities,” though most of the people on it aren’t famous, and it appears to have been sorted to only include people with Ashkenazi heritage."

Quoted from: 23andMe user data targeting Ashkenazi Jews leaked online

There are numerous additional news sources you can find online:

23andMe User Data Stolen in Targeted Attack on Ashkenazi Jews

At least a million data points from 23andMe accounts appear to have been exposed on BreachForums. While the scale of the campaign is unknown, 23andMe says it's working to verify the data.

www.wired.com

https://www.cshub.com/attacks/news/23andme-credential-stuffing

This appears to have happened on the same day that Hamas launched its terrorist attack on Israeli citizens. I don't know whether Hamas is directly involved in the breach, but it seems likely that either Hamas or an organization sympathetic to Hamas may be responsible. Users of 23&Me are being advised to change their passwords. I know someone who tried just now to change his password and was unable to do so.

 

[Orbit]

"Hackers have compiled a giant apparent list of people with Ashkenazi Jewish ancestry after taking that information from the genetic testing service 23andMe, which is now being shared on the internet.

"A database that has been shared on dark web forums and viewed by NBC News has a list of 999,999 people who allegedly have used the service. It includes their first and last name, sex, and 23andMe’s evaluation of where their ancestors came from. The database is titled “ashkenazi DNA Data of Celebrities,” though most of the people on it aren’t famous, and it appears to have been sorted to only include people with Ashkenazi heritage."

Quoted from: 23andMe user data targeting Ashkenazi Jews leaked online

There are numerous additional news sources you can find online:

23andMe User Data Stolen in Targeted Attack on Ashkenazi Jews

At least a million data points from 23andMe accounts appear to have been exposed on BreachForums. While the scale of the campaign is unknown, 23andMe says it's working to verify the data.

www.wired.com

23andMe User Data Stolen in Targeted Attack on Ashkenazi Jews

At least a million data points from 23andMe accounts appear to have been exposed on BreachForums. While the scale of the campaign is unknown, 23andMe says it's working to verify the data.

www.wired.com

This appears to have happened on the same day that Hamas launched its terrorist attack on Israeli citizens. I don't know whether Hamas is directly involved in the breach, but it seems likely that either Hamas or an organization sympathetic to Hamas may be responsible. Users of 23&Me are being advised to change their passwords. I know someone who tried just now to change his password and was unable to do so.

It seems like that list would be too big to be practically useful for anything, and 23&Me profiles don't include address/phone/email. Even I have 1% Ashkenazi in my profile; I'm sure there are millions of Americans who have it as a "trace ancestry". What could someone actually do with that information?

 

[Rachel Rugelach]

It seems like that list would be too big to be practically useful for anything, and 23&Me profiles don't include address/phone/email. Even I have 1% Ashkenazi in my profile; I'm sure there are millions of Americans who have it as a "trace ancestry". What could someone actually do with that information?

That's a comfort to know. Maybe the hackers who did this are counting on finding stupid buyers for their lists?

Nevertheless, it's disturbing news.

 

[Onasander]

While I'm concerned 23andme can be hacked (I'm a member).... wouldn't just having a obvious sounding Jewish names in a phone book be more risky? As far as tracking random Jews down is concerned? That's been going on for decades and nobody winced once over it in dread.

 

[Jayhawker Soule]

Today's emailed 23andMe "Update to our customers" begins ...

We recently learned that certain profile information – which a customer creates and chooses to share with their genetic relatives in the DNA Relatives feature – was accessed from individual 23andMe.com accounts. This was done without the account users’ authorization. We do not have any indication at this time that there has been a data security incident within our systems, or that 23andMe was the source of the account credentials used in these attacks.​

​

While our investigation is ongoing, at this time we believe the threat actor was able to access certain accounts in instances where users employed identical login credentials - that is, usernames and passwords that were used on 23andMe.com were the same as those used on other websites that had been previously compromised or otherwise available.​

​

If we learn that your data has been accessed without your authorization, we will contact you separately with more information.​

It's more than a little unnerving.

 

[Onasander]

No. Not if the file was 999,999. That's a block of users. It was yanked from a database.

 

[Jayhawker Soule]

That's been going on for decades and nobody winced once over it in dread.

Nobody? What planet are you from?

 

[Onasander]

I never once heard people upset about phone book listings. I'm 40 now, so had time to hear about it. I know you can opt out by request.

 

[Bthoth]

The claim that a religious identity is based in genealogy, is a form of racism. The religious observance is the basis of which person is which religion. There is no race in nature that is a religion. Judaism is not a race or blood line.


Darwin did not make a branch "On the Origins of Species" called Jew.

 

[Onasander]

The claim that a religious identity is based in genealogy, is a form of racism. The religious observance is the basis of which person is which religion. There is no race in nature that is a religion. Judaism is not a race or blood line.


Darwin did not make a branch "On the Origins of Species" called Jew.

It actually does matter a bit in Judiasm. Being born of a Jewish woman matters in determining who is a jew, but it also matters for the fathers status who his father was genealogically to be a Cohen. But merely having this genetic trait doesn't make you a jew if your ancestors left Judaism. Something I picked up from watching history lectures by a rabbi. They got alot of weird rules. I don't pretend to fully get it.

 

[Bthoth]

It actually does matter a bit in Judiasm.

To the misled and the bad of tangent teaching.

Being born of a Jewish woman matters in determining who is a jew, but it also matters for the fathers status who his father was genealogically to be a Cohen.

Again to the misled

But merely having this genetic trait doesn't make you a jew if your ancestors left Judaism.

Why not observe what a person does over who the parents are.

Something I picked up from watching history lectures by a rabbi. They got alot of weird rules. I don't pretend to fully get it.

you just offered a great example of what is ugly about some of the Rabid teachers. Misleading people and creating corrupt measures.

People are equally capable and when a religious teacher tries to alienate people based on the scope of a race or lineage, you have a clear evidence of racism.

 

[Onasander]

Are you saying I'm factually wrong (might be to a degree) or are you saying Jewish tradition over the last few thousand years is wrong on what qualifies as a Jew?

They are free to have their own qualifications.

 

[Bthoth]

Are you saying I'm factually wrong (might be to a degree) or are you saying Jewish tradition over the last few thousand years is wrong on what qualifies as a Jew?

NO....... but as I understand the wisdom of the theology. Mankind are brethren and equally capable.

They are free to have their own qualifications.

I often contest the leadership and will side with Love over divide

 

[Onasander]

I think the class structure is silly but clear genetic patterns have appeared as a result (ethnic traits that didn't exist 2000 years ago can be genetically mapped, hence this thread), so it isn't all foolishness. They latched onto some concept. Doesn't mean I particularly could care less who is descended from a defunct priestly caste 2000 years ago, but they like it, somehow gives a man added prestige. I'm descended from all sorts of things, including a German manatee in the 600s.... saw it pop up on geni.com

Apparently one of my German royal ancestors far before Charlemagne thought their claim to rule came from having a exotic ancestry of a mythical being. Had a drawing on the site, looked like a floating manatee. I'd follow him into battle for the sake of the tribe. That's the silliness my ancestors chose for prestige status. I don't mind others doing similar. Jews slayed goats on temple mount and 2000 years later get high caste status for it. OK. Tip my hat to you.

 

[Onasander]

Addressing Data Security Concerns​

October 6, 2023

We recently learned that certain 23andMe customer profile information that they opted into sharing through our DNA Relatives feature, was compiled from individual 23andMe.com accounts without the account users’ authorization.
After learning of suspicious activity, we immediately began an investigation. While we are continuing to investigate this matter, we believe threat actors were able to access certain accounts in instances where users recycled login credentials – that is, usernames and passwords that were used on 23andMe.com were the same as those used on other websites that have been previously hacked.
We believe that the threat actor may have then, in violation of our Terms of Service, accessed 23andMe.com accounts without authorization and obtained information from certain accounts, including information about users’ DNA Relatives profiles, to the extent a user opted into that service.

Committed to Safety and Security​

23andMe is committed to providing you with a safe and secure place where you can learn about your DNA knowing your privacy is protected. We are continuing to investigate to confirm these preliminary results. We do not have any indication at this time that there has been a data security incident within our systems, or that 23andMe was the source of the account credentials used in these attacks.
At 23andMe, we take security seriously. We exceed industry data protection standards and have achieved three different ISO certifications to demonstrate the strength of our security program. We actively and routinely monitor and audit our systems to ensure that your data is protected. When we receive information through those processes or from other sources claiming customer data has been accessed by unauthorized individuals, we immediately investigate to validate whether this information is accurate. Since 2019 we’ve offered and encouraged users to use multi-factor authentication (MFA), which provides an extra layer of security and can prevent bad actors from accessing an account through recycled passwords.

Recommendations​

We encourage our customers to take as much action to keep their account and password secure. Out of caution, we recommend taking the following steps:

• Confirm you have a strong password, one that is not easy to guess and that is unique to your 23andMe account. If you are not sure whether you have a strong password for your account, reset it by following the steps outlined here.
• Please be sure to enable multi-factor authentication (MFA) on your 23andMe account. You can enable MFA by following the steps outlined here.
• Review our Privacy and Security Checkup page with additional information on how to keep your account secure.

23andMe is here to support you. Please contact Customer Care at [email protected] if you need assistance with navigating these important steps to protect your account.
The post Addressing Data Security Concerns appeared first on 23andMe Blog.

 

[Onasander]

They made me remake my password, mininum 12 digits now.