Millions more 23andMe records leaked online

Another database belonging to genetic testing website 23andMe has allegedly been published on a dark net forum, just days after an initial leak was revealed.

An individual going by the alias Golem published a database on BreachForums containing sensitive information on four million users.

Subsequent TechCrunch investigations confirmed that at least some of the data published matched known and public information. Roughly two weeks ago, Golem announced stealing sensitive user data from 23andMe, claiming to have done so by means of credential stuffing.

August leak?

In credential stuffing, a hacker would take a list of previously stolen usernames and passwords, and with the help of automation, “stuff” the service with login attempts until one of them sticks. Further details were unavailable at the time.

The database Golem posted most recently contains records on four million users, reports said. The hacker said the data includes information on British individuals, including some of the “wealthiest people living in the U.S. and Western Europe.” A company spokesperson told TechCrunch that the company is aware of the news and is currently “reviewing the data to determine if it is legitimate.”

TechCrunch also speculates that this is possibly a follow-up to a leak that happened in early August this year. Back then, a user on a forum called Hydra posted a 23andMe user database, and claimed to have 300 terabytes of user data. The publication says that this sample matches, at least to some extent, to the data posted two weeks ago.

To try and minimize the damage, 23andMe asked users to update their passwords and turn on multi-factor authentication (MFA), before saying the leak happened because of its users’ poor password hygiene.

23andMe is a company that offers genetic testing services to consumers. A person would provide a saliva sample to the firm and would get information on their ancestry, as well as genetic predispositions to different diseases, conditions, and similar.