In a letter to victims who filed a lawsuit against the company, 23andMe blames its breach on customers for reusing passwords.

Hope this isn’t a repeated submission. Funny how they’re trying to deflect blame after they tried to change the EULA post breach.

  • Monument@lemmy.sdf.orgEnglish
    83·
    11 months ago

    Those are my questions, too. It boggles my mind that so many accounts didn’t seem to raise a red flag. Did 23&Me have any sort of suspicious behavior detection?

    And how did those breached accounts access that much data without it being observed as an obvious pattern?

    • douglasg14b@lemmy.worldEnglish
      152·
      11 months ago

      If the accounts were logged into from geographically similar locations at normal volumes then it wouldn’t look too out of the ordinary.

      The part that would probably look suspicious would be the increase in traffic from data exfiltration. However, that would probably be a low priority alert for most engineering orgs.

      Even less likely when you have a bot network that is performing normal logins with limited data exfiltration over the course of multiple months to normalize any sort of monitoring and analytics. Rendering such alerting inert, since the data would appear normal.

      Setting up monitoring and analysis for user accounts and where they’re logging from and suspicious activity isn’t exactly easy. It’s so difficult that most companies tend to just defer to large players like Google and Microsoft to do this for them. And even if they had this setup which I imagine they already did it was defeated.

      • sudneo@lemmy.worldEnglish
        3·
        11 months ago

        If the accounts were logged into from geographically similar locations at normal volumes then it wouldn’t look too out of the ordinary.

        I mean, device fingerprinting is used for this purpose. Then there is the geographic pattern, the IP reputation etc. Any difference -> ask MFA.

        It’s so difficult that most companies tend to just defer to large players like Google and Microsoft to do this for them.

        Cloudflare, Imperva, Akamai I believe all offer these services. These are some of the players who can help against this type of attack, plus of course in-house tools. If you decide to collect sensitive data, you should also provide appropriate security. If you don’t want to pay for services, force MFA at every login.