Did you use a fake name and a prepaid debit card to make your purchase? Well I’m glad I did though they can just track me based on relatives that also use the platform if they really wanted to.

I do not understand why anyone with tech knowledge would have participated in this honeypot. Please help me understand why there was trust.

is the essence of the privacy concern that data showing predisposition for diseases (or whatever sort of weakness) can be dystopia-used to discriminate (insurance, etc)? Or just privacy in general?

How about creating a virus to give a disease to everyone of a specific race

Assuming that technology even exists, you wouldn't need 23andMe to get the relevant genetic data.

you'd have to define "race" but the idea seems legit considering crispr-cas9

That's science fiction. No matter what you read in the popular press or scientific journals, engineering a virus specific enough to perfectly target a group of people sharing a common genetic history with perfect specificity and sensitivity, is still not something we could do. I also don't see this as being technically possible for some time.

I keep re-reading what you wrote, and I think it's less far fetched than you imply, for the following reasons.

Huge datasets labelled as to ancestry exist, characterizing distributions of alleles that imply "race", which is how Ancestry and 23andme, for American company examples, do some of their analyses.

At least two Nobel prizes were recently awarded, one to Doudna and Charpentier related to Crispr-CAS9 for context-sensitive genome edits, and another for mRNA (which was in development for a decade or so before the entire Covid repurposing arose).

So, I think the part missing, to your point, is the "vector" that would deliver a sequence of patch files, perhaps via CRISPR-cas9 etc, which would perhaps bind to the constellation of race-implication genome sites to collectively build some proteins of whatever sort of interest, whether for fitness repair or fitness reduction in the host.

I said what I said above based on 30+ years of experience in this field. Be aware that the entire field of gene therapy was paused for 20 years because a single patient died in a single study in the 90s.

Race is a proxy variable for genetic history and we have enough genetic history to identify what "race" people belong to, in a computational way, with a great deal of human judgement. Implementing that "logic" in the form of a gene therapy delivered as a virus is much harder. Molecular logic, these days, is fairly simple and doesn't allow us the level of accuracy you would need.

If you don't require 100% sensitivity and specificity the job is "easier". For example, what should your theoretical virus do to people who are children of two parents with very different genetic history? Which "race" do they belong to? And if you go down that path, you're basically going to have to convince your funders (because this would be an extremely expensive research project) that your weapon of mass destruction will likely kill some fraction of allies.

Those are just a couple things off the top of my head; I could write a whole book on how hard delivering gene therapy is.

yep, totally understand and agree it's a super vague notion, with super imprecise possible consequences.

Because I don't care about privacy and I wanted my DNA tested, duh.

I don't understand privacy nuts.

Emotions? We all make those emotional mistakes?

Because I needed to know whether I had genetic health issues. I assume you use a smart phone. If so, you've already given up your privacy. You're like the people that scream about someone having Alexa in their house while simultaneously carrying Siri everywhere in your pocket.

What exactly is someone going to do with my DNA? Any entity that's a threat to use it for something nefarious is going to get it from me pretty easily. They could grab any number of physical items that I've touched or left my hair on etc.

Should they do a better job of protecting the data? Yes. Am I going to freak out over something that will likely not affect my life in any way? Nope.

Privacy nuts are always going overboard about things that mean very little.

Genetic data sounds important but in the bigger scheme of things, it's probably the least manipulatable data about a person on the internet.

My genetic data is less weaponizable than if I uploaded hundreds of pictures of myself and my shared my social graph to Facebook, if I shared my political opinions on Twitter, if I commented/posted on Reddit boards of my interests and hobbies. It's also less weaponizable than the multitude of "invisible" data that I feed to Google, my incompetent local government, service providers, every shop that is shipping something to my home address.

I lose genetic data everywhere I go, every day. 50-100 hairs fall of my head, and I leave fingerprints on everything I touch. I "lose privacy" every day by walking into somebody else's photo/video/TikTok, and by mishandling of it by poor government/business entities.

Life's too short.

Please help me understand what negative consequence I am likely to experience because of this. Not something conceptual like "you don't have privacy!" - be specific.

People of Ashkenazi jewish descent might have a more tangible grasp on the negative downsides of this leak.

So you're saying - someone in the US is going to discover my ancestry and... do what? You can find far more inflammatory things about me online. Besides, if someone really wants to attack Jews, it would be a lot easier to find the address of their local synagogue. Or search the phone book for obvious last names.

There are a lot of lessons to learn from the 20th century, but I don't think "you have to hide your ancestry" is one of them.

Oh yeah - nothing bad has ever happened based on knowledge of a minority group's ancestry...

You shared your DNA data on the internet, time to review your security fundamentals.

Even if you didn't they'll likely have a relatives data.

True, but we should be responsible for ourselves to start with.

You can get my entire DNA data, https://my.pgp-hms.org/profile/hu80855C I can assure you I know more than a little about security, considered all the reasonable risks, and concluded that it's not really increasing my risk and is unlikely to do so any time in the future.

If that's really you, I give you a lot of credit for being bold. You and the CEO of LifeLock both. Hopefully your confidence doesn't blow up in your face the way his did, but when/if it does, you'll probably never know why it's happening to you exactly. The easier it is to link that data to your identity the riskier it'd be. I haven't seen the 23andme data, but if it includes names, addresses, email addresses, family members, etc they're going to be a lot worse off than you likely are.

My real name is David Konerding, so the linkage now is trivial. Again, I've evaluated the risk profile associated with my genome data and concluded that it's effectively non-existent, and will continue to be so.

My data isn't 23andme- it's a whole genome. 23andme's data collection is very limited, and in my experience, fairly optimistic about its predictive ability for health.

I don't have the expertise to quickly mine your genome for the juicy bits, so I'll have to trust that you've seen what's there and still couldn't see how any of that information could ever be used to prejudice someone against you, or reveal anything that could be exploited either today, or at any point in the future.

It's a bold position, especially given that we're still only learning what many of our genes signify. While I do worry that it may rise to the level of hubris in this case, I really have to admire your confidence all the same. I genuinely hope that your assessment of your risk is proven accurate with time and that your contribution to the Personal Genome Project never comes back to haunt you.

How do you factor in the opinions of people who are, or will be, genetically related to you?

I didn't.

Hah, nice, my data is here: https://globatic.blogspot.com/2013/10/the-23andme-full-and-r...

How do you know? Where can you check?

I would also like to know.

The email I received from them said "If we learn that your data has been accessed without your authorization, we will contact you separately with more information." So I guess receiving such an email is how you know at this point.

23andMe is trying to have us believe that multiple tens of thousands of their customers were hacked in a credential stuffing attack. With 1500 matches per person, assuming no overlapping relatives, you'd need somewhere around 10,000 successfully hacked accounts to get the amount of data they have (~14 million). In reality, many people have overlapping relatives with other people, so many more than 10,000 accounts would have needed to be attacked, all without 23andMe noticing anything suspicious. This seems very unlikely to me.

And while 23andMe claims that a credential stuffing attack was at the root cause of this leak, the hacker(s) who first posted about this leak on Hydra Market over 2 months ago claim that they simply used (abused?) an API that 23andMe offered to their academic and research collaborators.

The hacker(s) claimed to have 300TB of data, including raw data, but have not proven that the scope of the attack was that large. But if their claim is true, then the breach was definitely not due to a credential stuffing attack, but fits well with the hacker(s) claim of using an API.

So, if the extent is as claimed by the attacker(s), then it is much more likely that one of 23andMe's API was used to scrape everyone's data, not a credential stuffing attack. Either one of their collaborating researchers got hacked, or they had (have!?) an access control vulnerability in their API which allowed the attacker to again scrape everyone's data.

I cannot find much information about the API 23andMe offers, but I did find one on RapidAPI (https://rapidapi.com/23andme/api/23andme), and indeed if there was some sort of access control vulnerability or some sort of hack of an escalated user then with even 1 individual as a starting point, they could download the data using various endpoints (there's even an endpoint for the entire individual's genome...) and then get the relatives of that individual (an endpoint for that too) and then recursively do the same for all relatives until every person has been downloaded once.

At this point in time, I am highly suspicious of 23andMe's defense but until the attacker releases proof that they have raw data we can't really prove that they're wrong/lying about the actual magnitude of the attack. But I do believe their claim of using an API makes a lot more sense than the way 23andMe proposed, so I am very worried.

> and then get the relatives of that individual

so you're saying they used a genetic algorithm ? sorry, couldn't resist.

do you use lastpass? If the company is mentioning password use, I wonder if this was due to compromised lastpass vaults that were finally cracked.

How are you verifying you were in the leak?

What's crazy is that onlyfans content creators get so much slack for sending out video and audio of their phenotype.

23andMe grabs a person by the source code and somehow that isn't considered obscene.

I did 23andme and although I'm not happy about this, I admit I'm growing numb to all the leaks of information, and I kind of went into it with the assumption that it might be leaked at some point.

https://www.nih.gov/news-events/news-releases/nih-s-all-us-r...

https://www.nytimes.com/2013/06/18/science/poking-holes-in-t...

As you can surmise from those, the issues about DNA sharing are more general than 23andme, or even private companies.

I mean, therapy notes have been leaked, and hospitals have had medical records compromised.

I do genetics research and although 23andme does have sensitive information, the level of information they have is relatively low. People with certain polymorphisms might be at risk but most of it is pretty crude, and I suspect many of the people affected might know through nongenetic ways that they were at risk anyway. I think the genetics revolution people were predicting doesn't exist, or to the extent it does, it will require something different than what 23andme has.

Google or Apple has more damning and accurate information about someone than 23andme. If 23andme or anyone else had some mind-blowing insights into you personally based on your genes, they'd certainly sell that to people and they don't. Most of their selling points are in genealogy and things like that.

I don't mean to sound dismissive, this sucks and 23andme could/should have done things differently. It's just I think as a society we need something other than "live as a technohermit" or "implement such strict security you're at risk of shutting yourself out" and "become a permanent victim of darknet hackers and authoritarian tyrants". I also think people overestimate the information value of the genetic information 23andme has. Yes, it's significant, but it's really at this point limited to what they offer. There's no would-be 8yo serial killers out there that, if we only had 23andme information, would be able to "prevent" them from killing in some real-life version of Minority Report crossed with Gattaca. Maybe someday, with different information, but not now.

>Until individual execs in these mega-corps that piss in the face of their users bear individual consequence for this type of thing it’ll keep happening.

No, Until individuals stop using these mega-corps that piss in the face of their users and also bear individual consequence for this type of thing it’ll keep happening.