In a recent data breach, DNA testing company 23andMe is pointing fingers at its users, claiming that they were negligent with their passwords and therefore share responsibility for the incident. The breach resulted in the theft of 6.9 million user records, leading to legal action under the California Privacy Rights Act (CRPA). While 23andMe asserts that the stolen data cannot cause harm, experts argue that any type of data breach can have consequences, even without traditional personal identification information.
The company defends itself by citing security remediations it implemented after the breach. However, critics argue that placing the blame solely on users oversimplifies cybersecurity and neglects the company’s responsibility to protect user information. Furthermore, they emphasize that the question of responsibility in credential stuffing is a broader issue affecting numerous organizations.
Both users and service providers, like 23andMe, should take measures to enhance security. While users must exercise caution and avoid reusing passwords, service providers have a responsibility to implement robust security measures. Experts argue that there should be a minimum requirement for customer portal security to mitigate the risk of data breaches. By addressing this shared responsibility, organizations and individuals can work together to prevent such incidents in the future.

Collections

DNA testing company 23andMe blames users for a data breach resulting in the theft of 6.9 million user records. Experts argue that both users and service providers have a shared responsibility for cybersecurity.

23andMe Data Breach: Company Shifts Blame onto Users