23andMe, the DNA testing company, has fallen victim to a security breach after a hacker gained access and stole the personal genetic information of customers.
Users, many of whom have sensitive health information stored on the site, were alerted about the hack after some of the personal data was uploaded to a website online, the US-listed company revealed.
Potentially including private information about celebrities, the Californian biotech firm could not specify the extent of the compromised data, stating that hackers obtained details “compiled from individual 23andMe.com accounts without the account users’ authorisation”.
Appearing to be selling the data online, the hackers likely used credential stuffing by attempting users’ recycled login credentials from other compromised sites, although the investigation is still ongoing and the scale of the issue is yet to be confirmed.
After gaining access to the compromised accounts, the attackers were able to use a feature called ‘DNA Relatives’, a tool which shows you family members with similar genetic make-ups to develop a family tree, in which they were able to gather information about users whose accounts had not been hacked.
Claiming that its systems had not faced an attack or that it was the source of the credentials used, the group advised users to change passwords and set up multi-factor authentication.
Shares in 23andMe are trading flat pre-market, having jumped 13% on Tuesday before closing at around $0.92.