Friday, May 24, 2024

Hackers Leaks Millions of 23andMe User Details on Dark Web

A threat actor allegedly published 4.1 million genetic data profiles stolen from the DNA testing company 23andMe in dark web forums.

The British Royal Family, wealthy families that support Zionism, and the wealthiest individuals in the United States and Western Europe are among those whose information was disclosed.

The genetic profiles of 23andMe were published on Tuesday by a hacker going by the name Golem on the well-known cybercrime forum BreachForums.

After learning of the breach, the company contacted its customers and reminded them to take extra precautions to keep their accounts and passwords safe.

Hackers Using Credential Stuffing Attack

On October 6, 23andMe revealed that hackers had gained access to some user data. The company claimed that the hackers had used credential stuffing, a technique where they tried combinations of usernames or emails and corresponding passwords that were already known as a result of other data breaches, to gather the stolen data.

Document
FREE Demo

Deploy Advanced AI-Powered Email Security Solution

Implementing AI-Powered Email security solutions “Trustifi” can secure your business from today’s most dangerous email threats, such as Email Tracking, Blocking, Modifying, Phishing, Account Take Over, Business Email Compromise, Malware & Ransomware

The company said that when customers reused login information, that is when usernames and passwords used on 23andMe were the same as those used on other websites that had previously been hacked—threat actors were able to access specific accounts.

“Threat actor may have then, in violation of our Terms of Service, accessed 23andMe.com accounts without authorization and obtained information from certain accounts, including information about users’ DNA Relatives profiles, to the extent a user opted into that service”, the company said.

The hacker publishing the stolen information, Golem, seems to have first tried to sell the user details. On Wednesday, he stated: “I would like to remind you that even the data I’m sharing here is extremely valuable.”

On August 11, a hacker posted an advertisement on the Hydra forum for a set of 23andMe user data. According to a TechCrunch study, that collection of user data matched some of the user details exposed two weeks prior.

The hacker stated having 300 gigabytes of 23andMe customer data on Hydra, although the hacker offered no support for this claim.

Hence, the company advised customers to take additional precautions to keep their accounts and passwords safe and stated that they were seeking the help of third-party forensic experts and federal law enforcement officials.

The company requires all customers to change their passwords, and they encourage the usage of multi-factor authentication (MFA).

Protect yourself from vulnerabilities using Patch Manager Plus to patch over 850 third-party applications quickly. Take advantage of the free trial to ensure 100% security.

Website

Latest articles

Hackers Weaponizing Microsoft Access Documents To Execute Malicious Program

In multiple aggressive phishing attempts, the financially motivated organization UAC-0006 heavily targeted Ukraine, utilizing...

Microsoft Warns Of Storm-0539’s Aggressive Gift Card Theft

Gift cards are attractive to hackers since they provide quick monetization for stolen data...

Kinsing Malware Attacking Apache Tomcat Server With Vulnerabilities

The scalability and flexibility of cloud platforms recently boosted the emerging trend of cryptomining...

NSA Releases Guidance On Zero Trust Maturity To Secure Application From Attackers

Zero Trust Maturity measures the extent to which an organization has adopted and implemented...

Chinese Hackers Stay Hidden On Military And Government Networks For Six Years

Hackers target military and government networks for varied reasons, primarily related to spying, which...

DNSBomb : A New DoS Attack That Exploits DNS Queries

A new practical and powerful Denial of service attack has been discovered that exploits...

Malicious PyPI & NPM Packages Attacking MacOS Users

Cybersecurity researchers have identified a series of malicious software packages targeting MacOS users.These...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

Live API Attack Simulation

94% of organizations experience security problems in production APIs, and one in five suffers a data breach. As a result, cyber-attacks on APIs increased from 35% in 2022 to 46% in 2023, and this trend continues to rise.
Key takeaways include:

  • An exploit of OWASP API Top 10 vulnerability
  • A brute force ATO (Account Takeover) attack on API
  • A DDoS attack on an API
  • Positive security model automation to prevent API attacks

Related Articles