23andMe Tells Victims it’s Their Fault that Their Data was Breached
fliptop writes:
Facing more than 30 lawsuits from victims of its massive data breach, 23andMe is now deflecting the blame to the victims themselves in an attempt to absolve itself from any responsibility, according to a letter sent to a group of victims seen by TechCrunch:
"Rather than acknowledge its role in this data security disaster, 23andMe has apparently decided to leave its customers out to dry while downplaying the seriousness of these events," Hassan Zavareei, one of the lawyers representing the victims who received the letter from 23andMe, told TechCrunch in an email.
[...] But in a letter sent to a group of hundreds of 23andMe users who are now suing the company, 23andMe said that "users negligently recycled and failed to update their passwords following these past security incidents, which are unrelated to 23andMe."
"Therefore, the incident was not a result of 23andMe's alleged failure to maintain reasonable security measures," the letter reads.
Zavareei said that 23andMe is "shamelessly" blaming the victims of the data breach.
"This finger pointing is nonsensical. 23andMe knew or should have known that many consumers use recycled passwords and thus that 23andMe should have implemented some of the many safeguards available to protect against credential stuffing - especially considering that 23andMe stores personal identifying information, health information, and genetic information on its platform," Zavareei said in an email.
"The breach impacted millions of consumers whose data was exposed through the DNA Relatives feature on 23andMe's platform, not because they used recycled passwords. Of those millions, only a few thousand accounts were compromised due to credential stuffing. 23andMe's attempt to shirk responsibility by blaming its customers does nothing for these millions of consumers whose data was compromised through no fault of their own whatsoever," said Zavareei.
Previously:
- 23andMe: Profiles of 6.9 Million People Hacked
- 23andMe Says Private User Data is Up for Sale After Being Scraped
Read more of this story at SoylentNews.