On: 23andMe says user data stolen in credential stuffing attack

[hammock]

According to this tweet, the hackers likely got ALL of the data but only leaked a subset, 1.3 million records (only the ashkenazi Jews)

https://x.com/mattjay/status/1710370423311888724?s=20

[SaberTail → hammock]

That would explain how they got so much data with a probably small number of compromised accounts. Ashkenazi Jewish people were relatively genetically isolated from the rest of Europe and started from a relatively small founder population. Genetically, then, they're all detected as distant cousins of each other using standard metrics.

This means a typical Ashkenazi Jewish customer of 23andMe has a lot more relatives than most other customers, and so they'd be able to view that many more profiles.

[beaugunderson → hammock]

as a 23andMe user with a high percentage of Ashkenazi genes I expected my data to be in the leak but it wasn't so it's probably not all of the Ashkenazi data

[justinzollars → beaugunderson]

How did you verify? I am ashkenazi

[beaugunderson → justinzollars]

assuming your last name is the same as in your HN username you are not in the file either

(as to how I verified: the file is still available on the leak site)

[marcod → beaugunderson]

OK, that CSV is just a subset of the data they claim to have.... so our data might still be out there even if it wasn't in this file.

These are the headers:

  profile_id; account_id; first_name; last_name; sex; birth_year; has_health; ydna; mdna; current_location; regions; subregions; population_ids

First entry is

  Elon;Musk;Male;1971;...

[TedDoesntTalk → marcod]

Glad I used 23andMe with a fake name and UPS PO Box

[devb → TedDoesntTalk]

What did you use to pay for all of it?

[TedDoesntTalk → devb]

Prepaid visa that I bought with cash at the supermarket. It’s a lot of work but it… worked.

[1-6 → marcod]

There's a whole debate about whether Elon Musk has Jewish ancestry. Are you saying he is?

[marcod → 1-6]

I have almost 6% myself, but to me it feels like, if I don't even know about who it might have been in my family tree, it doesn't really count.

But yes, for EM it said "Ashkenazi;Balkan;British Irish" - no percentages in there - and I believe 23andme has confirmed the authenticity of the data.

[akvadrako → hammock]

That tweet has zero evidence this is anything more than using reused passwords. Certainly not all data.

[mock-possum → hammock]

Oh god, of course it’s a Jewish thing

If I live a hundred years I will never understand people’s obsession with the Jews

[Lord-Jobo → hammock]

Great, more neo-nazi terror. I love the 20's /s