Which data were they negligent with? I thought it was breaches on other sites that gave reused passwords.
Credential stuffing is a well understood part of the threat landscape that 23 and me negligently failed to account for, allowing hackers to access 7 million people’s info after hacking only 14 thousand users.
…because those 7 million people opted into sharing their data with everyone else.
No, they opted to share varying degrees of information with authorized users and close genetic matches, and 23andMe failed to protect them from a large scale takeover of accounts that made public the kind of information the company had promised to keep private to semi-private.
14,000 accounts compromise by the same entity. That’s absolutely the fault of the platform, not the users.
It’s not the responsibility of your grandma who’s researching family history to be aware of potential data security threats. It’s the responsibility of the multimillion dollar online company with massive, valuable data troves to not offer a feature that was just a data breach waiting to happen.
There are still all kinds of things a company can do to mitigate at least some of this. New browser, new location, forced two-factor auth, etc.
