14,000 reused passwords, 6.9 million people affected
23andMe’s breach started with credential stuffing on a small number of accounts. A sharing feature did the rest.
23andMe has now explained its data breach. Attackers logged in to about 14,000 accounts using passwords people had reused from other leaked sites. That’s credential stuffing, nothing clever. But through the DNA Relatives feature, those accounts could see information about relatives, and the total reached around 6.9 million people.
Two lessons.
For everyone: a reused password is a key someone else already has. Use a password manager and unique passwords, and turn on MFA where it’s offered.
For anyone running a product:
- Check passwords against known breached lists at sign-up and login.
- Rate-limit and watch logins for many accounts tried from the same sources.
- Offer MFA, and make it the default for sensitive data.
- Think about features that share data between accounts. One weak account then exposes many people who did nothing wrong.
“The users reused their passwords” is true. It’s also the most predictable thing in security, so plan for it.