California’s attorney general sued Chrome Holding Co., the company formerly known as 23andMe, alleging inadequate protection of sensitive user data after a 2023 breach. The breach affected nearly 7 million people nationwide and involved about 14,000 accounts being accessed. The cyberattack used credential stuffing, leveraging users’ weak or reused passwords and stolen credentials from prior breaches. The lawsuit seeks civil penalties and injunctions to prevent further violations of California privacy laws. The company acknowledged the breach and the attackers’ access method. Prosecutors said the company did not implement common safeguards such as password resets or multifactor authentication and only began investigating after the stolen data was offered for sale and ransom demands were made.
"The cyberattack utilized “credential stuffing,” which takes advantage of customers' tendency to use weak or common passwords or reuse passwords between multiple accounts. The attackers used stolen user account credentials including ones from a massive data breach in October 2017 that affected MyHeritage, one of 23andMe's former partners. After that breach, 23andMe did not take common protocols such as asking customers to reset their passwords or use multifactor authentication."
"“23andMe's security measures were so lax that the threat actor was able to operate undetected within 23andMe's systems for over five months, and remarkably, 23andMe only began investigating after the threat actor offered the stolen user data for sale on the dark web and reached out to 23andMe to demand a ransom,” prosecutors said in the complaint."
"Attorney General Rob Bonta filed the lawsuit against Chrome Holding Co., which 23andMe rebranded under after filing for bankruptcy last March. 23andme is known for its direct-to-consumer DNA test kits that provided customers information on their ancestry and genetic predispositions for certain health conditions. The lawsuit calls for various civil penalties against 23andMe and injunctions blocking the company from further violations of California's privacy protection laws."
"The company has acknowledged that it suffered a major security breach in 2023 that resulted in about 14,000 accounts accessed, through which they were able to steal the data of nearly 7 million customers. In October 2023, the stolen data appeared for sale on the dark web, wit"
Read at Fortune
Unable to calculate read time
Collection
[
|
...
]