741
23andMe frantically changed its terms of service to prevent hacked customers from suing (www.engadget.com)
submitted 2 years ago by to c/technology@lemmy.world
40 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 58 points 2 years ago (3 children)

PSA: you can request deletion of your 23andMe account. It won’t do anything for this past hack, but it’ll at least prevent your data from being included in future hacks (assuming they actually completely delete your data like they’re supposed to).

  • permalink
  • fedilink
  • source
  • hideshow 6 child comments
    •
  • [–] 32 points 2 years ago (1 child)

    it's almost always a soft delete, that is, change active field in database to false, coupled with their terms of service that state vaguely how they start the deletion process which could take months and how they may still keep certain data for legitimate purposes.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 24 points 2 years ago (1 child)

    And this is why I wish we adopted GDPR more... if they are compliant, then they have to remove all data held when requested. Too bad the US will never care that much to respect individuals' data like that.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 3 points 2 years ago (1 child)

    Exactly. I made a GDPR request for deletion. They can get in big trouble if they are soft deleting.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 2 years ago (1 child)

    Have they ever been audited?

    How does the legal authority work with GDPR if the company's physical and financial operations are entirely within the US? Would the GDPR even be allowed to audit them without their consent?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 2 years ago

    No idea if they’ve been audited. GDPR doesn’t require it. My understanding is that American companies doing any business or having any users in the EU need to be GDPR compliant for those users. I don’t think that’s been challenged in any courts yet.

  • permalink
  • fedilink
  • source
  • parent
  • [–] -1 points 2 years ago* (1 child)

    Why would you this wasn't even a hack for my understanding?

    It was a password stuffing attack. Meaning that a bunch of users with reused crappy passwords had their accounts accessed with their legitimate passwords by attackers.

    I'm not sure why this reflects horribly on the company in a way that would encourage one to delete their account?

    This would be like leaving the key to your apartment in a public place and then complaining about your landlords terrible security when someone accesses your house when you're not there.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 10 points 2 years ago*

    They stuffed passwords to get them access to information not just on the compromised accounts' profiles but to detailed data on a large group of other people whose accounts weren't compromised through a function within 23andMe's database browser.

  • permalink
  • fedilink
  • source
  • parent