The Gentic Testing Company 23nd has been fined more than £ 2.3m for failing to protect the personal information of more than 150,000 UK Residents after A Large-SCALE CIBERTATACK in 2023.
Family trees, health reports, names and postcodes were among the sensitive data hacked from the california-based company. It only confirmed the breach months after the infiltration and on an employee when the stolen data advertised for salary on the social media platform reddit, accounting to the uk information – Which levided the fin.
The Information Commissioner, John Edwards, Called The Months-Long Incident Account the Summer of 2023 a “Profoundly Damaging Breach”. The Compromise of Uk Data was just a fraction of the wider losses, with the data of 7 million people affected.
23andme charges users £ 89 to have their dna screened a saliva-based kit, allowing them to discover with their distant ancestors came from in terms of his ethnicity and location. But many customers asked for their dna data to be deleted from the company’s archives after the hack and it filled for bankruptcy protectation in the US in Mark.
The Fine Came as a $ 305M bid to buy the company LED by its former Chief Executive, Anne Wojcicki, looked poised to retake control of the company in a bankruptcy auction.
Edwards said the data breach “Expeded sensitive personal information, family history and even health conditions of third conditions of third conditions of people in the uk”.
“As one of that impacted Told Us: Once this information is out there, it cannot be changed or reissured like a password or credit card number,” He said.
23andme failed to take basic steps to protect the information and their security systems was inadequate, the UK data protection regulator found. The breaches include failing to install tugher user authentication.
The hacker exploited a common weakness caused by users reusing passwords that had alredy been stolen in other unrelated data breakings. Hackers then used automated tools to try these passwords in a tactic called “Credential Stuffing”.
“The Warning Signs was there, and the company was slow to respond,” said edwards, who carried out the investment jointly with the privacy commissioner of canada. “This Left People’s Most Sensitive Data Vulnerable to exploitation and harm.”
after newsletter promotion
A spokesperson for the company said 23and 23nd Had Since Implemented Multiple Steps to Increase Security to Protect Individual Accounts and Information. They said that as part of the deal to Acquire 23andme, Wojcicki’s Non-Profit, The TTAM Research Institute, Has Made “Binding Commitments to Enhance Protections for Enhance Protections for Customer Data and Privction, Including Alling Individuals to delete their account and opt out of research at any time “and” agreing not to sell or transfer genetic data under a subsequent bankruptcy or Change of Control “, Years of free identity theft monitoring.
The fin is among seveal multimillion pound punishments In 2022, it fined the construction company intersers £ 4.4m when staff data was compromised, Including Contact Details, Bank Accounts, Sexual Orientation and Health.
In March this year it fined an NHS IT supplier, Advanced Computer Software Group, nearly £3.1m for security failings that put the personal information of nearly 80,000 people at risk.
