In the aftermath of 23andMe’s recent data breach, the company is facing allegations of deflecting blame onto its users instead of taking responsibility. According to reports, more than 30 lawsuits have been initiated against 23andMe by victims of the breach, and the company’s response has only fueled the ongoing debate.
In a letter addressed to a group of victims, 23andMe appears to be attempting to shift responsibility away from the company and onto its customers by suggesting that users’ negligence in recycling and failing to update their passwords played a role in the breach. The letter states, “Therefore, the incident was not a result of 23andMe’s alleged failure to maintain reasonable security measures.”
Hassan Zavareei, a lawyer representing some of the victims, expressed his concern, stating, “Rather than acknowledge its role in this data security disaster, 23andMe has apparently decided to leave its customers out to dry while downplaying the seriousness of these events.”
The genetic testing company publicly disclosed in December that hackers had successfully breached the security and stolen the genetic and ancestry data of 6.9 million users, constituting almost half of its customer base. The breach began with the compromise of around 14,000 user accounts, employing a technique known as credential stuffing, wherein hackers leveraged known passwords associated with the targeted users.
Dante Termohs, a 23andMe customer impacted by the breach, expressed his dismay at the company’s attempt to evade responsibility, saying, “It is appalling that 23andMe is attempting to hide from consequences instead of helping its customers.”
In addition to deflecting blame, 23andMe has also made changes to its terms of service, making it more challenging for victims to join together in legal claims against the company. Legal experts have criticized these changes as “cynical” and “self-serving,” aimed at protecting 23andMe from potential class-action lawsuits and mass arbitration claims.
Image credit: Unsplash
