Hacker News new | ask | show | jobs
by mfld 976 days ago
Sure , there are several big issues in compromised DNA profiles. See also: https://www.ecseq.com/blog/2019/privacy-implications-of-gene...

But let's wait until it's clear whether raw data was actually leaked.

1 comments

Isn’t the raw data pretty much guaranteed to be leaked ?

I remember a few years ago there was a button to download raw data.

So if you can log in you can just download.

23andMe shows up to 1500 DNA Relatives for each user (outside of subscription features).

What we know thus far is that the malicious persons who compiled these datasets are scraping user profiles of DNA Relative matches who are related to the accounts which they were able to directly compromise (likely as a result of password reuse). The posters claim to have accessed around ~7M profiles, which means the lower limit for directly compromised accounts is ~4700, although likely much higher (maybe a factor of 10?), given the overlap in match lists, and provided that their boasts are true. So that's potentially ~5000-50000 profiles.

For those directly compromised accounts raw data could be downloaded. For profiles scraped, it would not be feasible to obtain raw data. However it is possible that partial genetic sequences might be assembled for matches. This was at the core of security researchers' investigations into GEDmatch a few years ago [0]. 23andMe does not face the same vulnerability, however with enough compromised accounts it is likely possible to infer a modest proportion of the DNA sequences of profiles which are known to match.

[0] https://www.washington.edu/news/2019/10/29/genetic-genealogy...