23andMe, the DNA testing company, admitted Monday that a data breach in October accessed the personal information of millions more users’ personal data than originally announced.
On Friday, the company said that hackers accessed the personal data of 14,000 customers, or about 0.1% of users, as well as “a significant number of files containing profile information about other users’ ancestry.”
The significant number brings the total number of users affected to 6.9 million, roughly half its user base, according to new reporting Monday.
A 23andMe spokesperson said the hackers gained access to the information of roughly 5.5 million users who opted-in to share data via the company’s DNA Relatives feature, according to a report from TechCrunch. The personal information included names, birth years and percentage of DNA in common with the sharer.
On top of that, 1.4 million people who opted-in to DNA Relatives also had their Family Tree profile information accessed, the report found.
In October, 23andMe acknowledged the data breach in a blog post, identifying "credential stuffing" as the method of intrusion. In this type of attack, cybercriminals exploit leaked usernames and passwords from previous breaches to gain unauthorized access.
Shares of 23andMe jumped more than 9% on Monday.
Contact Andrew Kessel at andrew.kessel@proactiveinvestors.com
Follow him on X, formerly Twitter, @andrew_kessel