The disastrous 23andMe data breach just led to a regulatory investigation

Regulators announced a joint investigation into last year’s data breach at genetic testing company 23andMe, including the company’s handling of the incident.

The investigation will be conducted by the UK Information Commissioner’s Office (ICO) and the Office of the Privacy Commissioner of Canada (OPC), using the combined resources of both bodies.

The study will focus on three key areas, the first of which will be the scope of information disclosed during the breach and the extent to which such information may be potentially harmful to victims of the breach.

Crucially, it will also review whether 23andMe had “adequate safeguards” in place to protect sensitive customer data in the first place and whether the company provided “adequate notice” of the breach to both regulators.

The ICO and OPC will consider whether 23andMe has provided affected individuals with the same level of breach notification required under Canadian and UK data protection law.

Public trust in a service like 23andMe is “essential”, the ICO said in its statement, because the company is the “custodian of highly sensitive” data such as genetic information.

“In the wrong hands, an individual’s genetic information can be used for surveillance or discrimination purposes,” said Canadian Privacy Commissioner Philippe Dufresne.

“Ensuring that personal information is adequately protected from attacks by malicious actors is an important goal of privacy authorities in Canada and around the world,” he added.

ICO chief executive John Edwards added to these views, stating that “people must trust that any organization processing their most sensitive personal data has appropriate safeguards and safeguards in place.”

“This data breach was international in scope and we look forward to working with our Canadian counterparts to ensure that the personal data of individuals in the UK is protected,” he added.

23andMe’s gibberish response takes center stage

IN December 202323andMe confirmed that it was the victim of a data breach in which cybercriminal groups reportedly stole and disclosed the ancestry data of nearly 7 million people, representing half of the company’s customer base at the time.

An investigation into the company’s attack revealed that hackers used credential spoofing attacks to gain access to 23andMe’s systems.

The real problem for 23andMe, however, was its response to the breach, in which the company blamed the victims and demanded that users “failed to update passwords due to past security incidents unrelated to 23andMe” in a letter to the victims.

In its letter, 23andMe said the breach was not due to a “failure to maintain appropriate security measures,” but rather the cybersecurity practices of its users.

This claim did not go down well with many people and Added insult to injury for 23andMe when just a few weeks later the company revealed that the data breach had taken 5 months to be discovered.

Despite initial attempts to shift blame, 23andMe’s security posture and subsequent breach notifications are now in the firing line of regulators on both sides of the Atlantic.