The United Kingdom and Canada privacy watchdogs announced a joint investigation this week to determine the security lapses in the genetic testing company 23andMe’s October data breach, which leaked ancestry data of 6.9 million individuals worldwide.
The UK Information Commissioner John Edwards and Privacy Commissioner of Canada Philippe Dufresne will lead the investigation, pooling the resources and expertise of their respective offices.
Focus of 23andMe Data Breach Investigation
The joint investigation will examine three key aspects:
Scope of Information Exposed: The breadth of data affected by the breach and the potential harm to individuals arising from it.
Security Measures: Evaluate whether 23andMe had adequate safeguards to protect the sensitive information under its control.
Breach Notification: Review whether the company provided timely and adequate notification to the regulators and affected individuals, as mandated by Canadian (PIPEDA) and UK (GDPR) data protection laws.
Edwards said the investigation was needed to garner the trust of people in organizations that handle sensitive personal data. He stated:
“People need to trust that any organization handling their most sensitive personal information has the appropriate security and safeguards in place. This data breach had an international impact, and we look forward to collaborating with our Canadian counterparts to ensure the personal information of people in the UK is protected.â€
Dufresne on the other hand stated the risks associated with genetic information in the wrong hands. He said:
“In the wrong hands, an individual’s genetic information could be misused for surveillance or discrimination. Ensuring that personal information is adequately protected against attacks by malicious actors is an important focus for privacy authorities in Canada and around the world.â€
The data protection and privacy laws in the UK and Canada allow such joint investigations on matters that impact both jurisdictions. Each regulator will assess compliance with the relevant laws they oversee.
Neither of the privacy commissioner offices however provided further details on how they would charge or penalize 23andMe, if found in violation of GDPR or PIPEDA. “No further comment will be made while the investigation is ongoing,†the UK ICO said.
Genetic Testing Company 23andMe Data Breach Timeline
23andMe first disclosed details of the October data breach in an 8-K filing with the U.S. Securities and Exchange Commission. The genetic testing company said attackers scraped profiles of 23andMe users who opted in to using the company’s DNA Relatives feature. This profiling feature connects users with genetic distant relatives – or other 23andMe users who share their bits of DNA.
The attackers used credential stuffing attacks that affected 0.1% of user accounts, the company told SEC. Using these accounts as a launchpad, hackers were able to access “a significant number of files containing profile information about other users’ ancestry.â€
Threat actors claimed on underground forums that they were able to siphon “20 million pieces of code†from 23andMe. The claimed data set included information DNA ancestry backgrounds belonging to more than 1.3 million Ashkenazi Jewish and Chinese users.
By the end of October, another threat actor claimed compromise of 4 million genetic profiles, which the company also investigated. The genetic testing company 23andMe said it notified the affected 6.9 million users – 5.5 million DNA Relatives profiles and 1.4 million Family Tree profile – in December.
The company told federal regulators that the data breach incident was set to incur between $1 million and $2 million in one-time expenses.
The company faces at least 30 class action lawsuits in U.S.state and federal jurisdictions as well as in Canada.
23andMe blamed the customers’ poor security hygiene for the breach and has since made two-step verification a prerequisite for account logon. It also mandated customers to reset their passwords.
Source: Read More
