Genetic testing provider 23andMe is currently facing multiple lawsuits due to an October credential stuffing attack that resulted in the theft of customer data. In response, the company has made changes to its Terms of Use, making it more difficult for customers to sue them.

Last October, a cybercriminal attempted to sell 23andMe customer data but ultimately failed, leading them to leak the data of 1 million Ashkenazi Jews and 4.1 million people living in the United Kingdom.

Our IT Services team learned that the data was obtained through credential stuffing attacks used to breach customer accounts. The cybercriminals exploited a limited number of these accounts to access the ‘DNA Relatives’ feature and scrape the data of millions of individuals.

In a recent update, 23andMe disclosed that a total of 6.9 million people were affected by the breach — 5.5 million through the DNA Relatives feature and 1.4 million through the Family Tree feature.

Terms of Use Updates: Preventing Lawsuits?

As a result of the breach, 23andMe is now facing numerous lawsuits. In an effort to minimize legal troubles, the company updated its Terms of Use on November 30th. The updated terms now require mandatory arbitration for all disputes, prohibiting jury trials or class action lawsuits.

The updated Terms of Use state, “These terms of service contain a mandatory arbitration of disputes provision that requires the use of arbitration on an individual basis to resolve disputes in certain circumstances, rather than jury trials or class action lawsuits.”

23andMe sent emails to customers informing them of the change and advising that they had 30 days to notify the company at [email protected] if they disagreed with the new terms. Customers who disputed the update would remain on the previous Terms of Service.

However, Nancy Kim, a Chicago-Kent College of Law professor, told Axios that this change in the Terms of Use may not protect 23andMe from lawsuits. It could be difficult for the company to prove that they provided reasonable notice for customers to opt out of the new terms.

Stay Informed and Protect Your Data

As cyber threats continue to evolve, it’s more important than ever to stay informed and take proactive measures to safeguard your personal data. We’re here to help you navigate the ever-changing world of cybersecurity, providing you with the information and resources you need to stay safe online.

Contact us to learn more about how to protect yourself from cyber threats, and remember to come back regularly for the latest updates on cybersecurity developments.

Imagine getting a DNA test for fun or curiosity, only to have your sensitive genetic information stolen by cybercriminals. That’s exactly what happened to millions of 23andMe customers this past October. As a result, the genetic testing provider is now facing multiple lawsuits and has decided to change its Terms of Use to make it harder for people to sue the company. Let’s dive into the details and see what this means for you.

The Credential Stuffing Attack on 23andMe

In October, a malicious threat actor tried to sell 23andMe customer data. When they failed to find a buyer, they leaked the data of 1 million Ashkenazi Jews and 4.1 million people living in the United Kingdom. We found out from 23andMe that the data was obtained through a credential stuffing attack, wherein the criminals breached customer accounts using stolen login information. They then used the “DNA Relatives” feature to scrape the data of millions of individuals.

Since then, 23andMe has reported that a total of 6.9 million people were impacted by the breach – 5.5 million through the “DNA Relatives” feature and 1.4 million through the “Family Tree” feature.

23andMe’s Response: Updating Terms of Use to Prevent Lawsuits

As you can imagine, this massive breach has led to a flurry of lawsuits against the company. In response, 23andMe updated its Terms of Use on November 30th to include a provision requiring mandatory arbitration for all disputes, rather than allowing for jury trials or class action lawsuits.

The updated Terms of Use state, “These terms of service contain a mandatory arbitration of disputes provision that requires the use of arbitration on an individual basis to resolve disputes in certain circumstances, rather than jury trials or class action lawsuits.”

Users were informed of this change via email, and they had 30 days from the notification to disagree with the new terms by contacting 23andMe. Those who disputed the update would remain on the previous Terms of Service.

Will This Change Protect 23andMe from Lawsuits?

According to Nancy Kim, a professor at the Chicago-Kent College of Law, it’s unlikely that this change in the Terms of Use will protect 23andMe from lawsuits. She told Axios that it would be difficult for the company to prove they gave customers reasonable notice to opt out of the new terms.

What Does This Mean for You?

This situation serves as a reminder of the importance of cybersecurity and protecting your personal data. If you’ve used 23andMe or other genetic testing services, it’s crucial to stay informed about any potential breaches and take action to protect yourself.

And for those of us who aren’t directly affected, this case demonstrates the need for strong cybersecurity measures across all industries, especially when sensitive data is involved. As we continue to rely more and more on technology, the potential for breaches and cyberattacks only increases.

Stay informed and stay safe by keeping up with the latest cybersecurity news and best practices. We’re here to help you navigate the complex world of digital security, so don’t hesitate to reach out if you have any questions or concerns. Together, we can work to protect our data and our privacy.