Just three years ago, DNA testing company 23andMe was the golden child of Wall Street and Main Street. Today, the company is struggling to remain listed on the Nasdaq.
Credential stuffing is a well understood part of the threat landscape that 23 and me negligently failed to account for, allowing hackers to access 7 million people’s info after hacking only 14 thousand users.
It’s not the responsibility of your grandma who’s researching family history to be aware of potential data security threats. It’s the responsibility of the multimillion dollar online company with massive, valuable data troves to not offer a feature that was just a data breach waiting to happen.
I remember when the housing market crashed and hearing all these rich folks talk about how it is poor people who are responsible for not knowing they couldnt afford their homes.
Yeah so why exactly do we have a credit rating system if it isn’t rating credit?
You are completely correct. It is not on regular people to be experts on cyber security and somehow know that the company is doing their job and will do their job forever.
Cmon, we know their target market was dumbasses. How many dumbasses do you know that use mfa, or that actually look at a login notification before hitting “yes, it’s me”?
Refreshing to have some sort of consequences for being negligent with people’s data
Too bad the consequences are not prison.
Hear hear
Which data were they negligent with? I thought it was breaches on other sites that gave reused passwords.
Credential stuffing is a well understood part of the threat landscape that 23 and me negligently failed to account for, allowing hackers to access 7 million people’s info after hacking only 14 thousand users.
…because those 7 million people opted into sharing their data with everyone else.
It’s not the responsibility of your grandma who’s researching family history to be aware of potential data security threats. It’s the responsibility of the multimillion dollar online company with massive, valuable data troves to not offer a feature that was just a data breach waiting to happen.
I remember when the housing market crashed and hearing all these rich folks talk about how it is poor people who are responsible for not knowing they couldnt afford their homes.
Yeah so why exactly do we have a credit rating system if it isn’t rating credit?
You are completely correct. It is not on regular people to be experts on cyber security and somehow know that the company is doing their job and will do their job forever.
There are still all kinds of things a company can do to mitigate at least some of this. New browser, new location, forced two-factor auth, etc.
Cmon, we know their target market was dumbasses. How many dumbasses do you know that use mfa, or that actually look at a login notification before hitting “yes, it’s me”?