23andMe Revamps Terms of Use with Robust Measures to Thwart Data Breach Lawsuits

Imagine getting a DNA test for fun or curiosity, only to have your sensitive genetic information stolen by cybercriminals. That’s exactly what happened to millions of 23andMe customers this past October. As a result, the genetic testing provider is now facing multiple lawsuits and has decided to change its Terms of Use to make it harder for people to sue the company. Let’s dive into the details and see what this means for you.

The Credential Stuffing Attack on 23andMe

In October, a malicious threat actor tried to sell 23andMe customer data. When they failed to find a buyer, they leaked the data of 1 million Ashkenazi Jews and 4.1 million people living in the United Kingdom. We found out from 23andMe that the data was obtained through a credential stuffing attack, wherein the criminals breached customer accounts using stolen login information. They then used the “DNA Relatives” feature to scrape the data of millions of individuals.

Since then, 23andMe has reported that a total of 6.9 million people were impacted by the breach – 5.5 million through the “DNA Relatives” feature and 1.4 million through the “Family Tree” feature.

23andMe’s Response: Updating Terms of Use to Prevent Lawsuits

As you can imagine, this massive breach has led to a flurry of lawsuits against the company. In response, 23andMe updated its Terms of Use on November 30th to include a provision requiring mandatory arbitration for all disputes, rather than allowing for jury trials or class action lawsuits.

The updated Terms of Use state, “These terms of service contain a mandatory arbitration of disputes provision that requires the use of arbitration on an individual basis to resolve disputes in certain circumstances, rather than jury trials or class action lawsuits.”

Users were informed of this change via email, and they had 30 days from the notification to disagree with the new terms by contacting 23andMe. Those who disputed the update would remain on the previous Terms of Service.

Will This Change Protect 23andMe from Lawsuits?

According to Nancy Kim, a professor at the Chicago-Kent College of Law, it’s unlikely that this change in the Terms of Use will protect 23andMe from lawsuits. She told Axios that it would be difficult for the company to prove they gave customers reasonable notice to opt out of the new terms.

What Does This Mean for You?

This situation serves as a reminder of the importance of cybersecurity and protecting your personal data. If you’ve used 23andMe or other genetic testing services, it’s crucial to stay informed about any potential breaches and take action to protect yourself.

And for those of us who aren’t directly affected, this case demonstrates the need for strong cybersecurity measures across all industries, especially when sensitive data is involved. As we continue to rely more and more on technology, the potential for breaches and cyberattacks only increases.

Stay informed and stay safe by keeping up with the latest cybersecurity news and best practices. We’re here to help you navigate the complex world of digital security, so don’t hesitate to reach out if you have any questions or concerns. Together, we can work to protect our data and our privacy.