Earlier this month, on October 6, a cybercriminal exposed a trove of user data stolen from the genetic testing giant 23andMe. The same malicious actor has struck again and disclosed an additional 4.1 million genetic records of people.
Using the pseudonym ‘Golem’, the cybercriminals leaked the data on the infamous cybercrime forum, BreachForums. An investigation by TechCrunch found that some of the leaked data matched with the public 23andMe records.
Golem claims that the data contains the genetic information of some of the “wealthiest people living in the US and Western Europe”, including the Rothschilds and the Rockefellers.
Andy Kill, the spokesperson of 23andMe, said that the company is still “reviewing the data to determine if it is legitimate.”
“Our investigation is ongoing, and if we learn that a customer’s data has been accessed without their authorization, we will notify them directly with more information,” the company told BleepingComputer.
23andMe claims that, in reality, only a few customer’s accounts were breached. However, many users have opted for the DNA Relatives feature, exposing much more information.
On October 6, 23andMe’s servers were breached, and the data was stolen. The threat actor employed credential stuffing, a technique where cybercriminals try a combination of emails and passwords available to the public from previous breaches.
23andMe attributed the breach to reused passwords.
In response to that incident, 23andMe urged users to change their passwords and opt for multi-factor authentication. The company also engaged with a third-party forensic expert to trace the leak.
This beach raised several questions, the primary one being what techniques other than credential stuffing were used by the threat actor and how much data is still with the cybercriminal.
The hacking seems to have been in process for several months. TechCrunch discovered that on August 11, cybercriminals on the Hydra cybercrime forum leaked some 23andMe data. This data matched with the October 6 leak.
Experts are still unclear on how much data the cybercriminal possesses and the extent of the breach. The company has no answers either.
In the News: CBI crackdowns on tech support scams and crypto frauds in India
