Gene testing firm 23andMe confirms legitimacy of stolen data sold by hackers: Report  

Biotech firm 23andMe confirms customers' data stolen by hackers via credential-stuffing attack. Attackers used “DNA Relatives” feature to scrape data of matches to launch attack. Highlights threat of reusing passwords, which can be used to compromise multiple accounts.

U.S.-based biotechnology and genomics firm has confirmed customers’ samples of saliva data is being sold by hackers. The genetic testing company receives samples from people who wish to know their ancestry and genetic predisposition.

The company attributes the stolen data to credential-stuffing attacks, a report Bleeping Computer said.

Threat actors leaked samples of data that were allegedly stolen from a genetics firm and were selling the data packs belonging to 23andMe customers. Threat actors claim to have access to bulk data that they are willing to sell for $1-$10 per 23andMe account, depending on how many were purchased, the report shared.

Breached information includes full names, usernames, profile photos, sex, data of birth, genetic ancestry results, and geographical locations.

(For top technology news of the day, subscribe to our tech newsletter Today’s Cache)

23andMe has attributed the data being sold to a credential stuffing attack. The company also said there is no indication of a data breach within its systems.

Credential stuffing is a cyberattack where cybercriminals make use of compromised credentials to gain unauthorsied access to protected accounts.