Initially Posted In: Cyber Security Intelligence

As a cybersecurity professional and expert witness, I like to keep an eye on legal cases that set precedents. Case law allows the public to see the facts of any given case, and more importantly, the judge’s decisions. These decisions create a body of law that can set a precedent for judges in making future decisions on similar issues.

The principle of ‘stare decisis’, meaning ‘to stand by things decided’ is central to case law, ensuring legal consistency and predictability. Unfortunately, in the UK, and similarly the US, the vast majority of cases are settled out-of-court and very often bind both parties from disclosing any settlements, concessions or decisions based on the facts.

There is potentially an interesting case law in the offing in the US. 23andMe is a company that provides genetic testing for health and ancestry information. In October 2023, a hacker claimed to have breached 23andMe and sold access on the darkweb for between $1 to $10 per profile. In December 2023, 23andMe admitted that approximately 14,000 people had their accounts directly accessed and that data from a further 1.4 million to 6.9 million customers, depending on reports, had been accessed as a result of preferences that they had set, allowing “potential genetic relatives” to identify them.

As a result of the breach, a number of legal cases have sprung up against 23andMe. As part of their defence, 23andMe have stated that the unauthorized access to user accounts had been a result of a “credential stuffing” attack.

A credential stuffing attack is where attackers use automated scripts to try a large volume of usernames and password combinations against a website or multiple websites. These combinations are often obtained from previous data breaches. The aim is to gain unauthorized access to accounts, exploiting the fact that people often reuse passwords across multiple sites.

As such, 23andMe are essentially saying that it is not their fault that the approximately 14,000 accounts were compromised, because users were re-using passwords that had been breached previously, and that users had failed to update passwords or apply additional, multi-factor verification methods. As for the remaining nearly 7 million individuals, they opted to share their information within the platform.

Credential stuffing could potentially be detected, I’m making no assumptions as to the sophistication of the attacker’s methods or the detection mechanisms within 23andMe’s infrastructure. Such an attack would typically present as tens or hundreds or thousands of unsuccessful login attempts from one or multiple IP addresses. Intermixed with that would be the successful logins for genuine users of the site. This though only accounts for the 14,000 directly compromised accounts. The remaining 6.9 million impacted users opted to share their data on the platform.

There’s going to be many arguments on both sides regarding this case. Ultimately, I suspect that this will come down to a decision regarding duty of care, and who that duty of care lies with. On the one hand, detecting credential stuffing attacks and blocking based on IP addresses, is feasible. On the other hand, threat actors often hide behind VPN’s or infrastructures used to co-host legitimate services. As such, blocking access from these may impact legitimate users and functionality.

Notifying users of logins from new devices or locations is also perfectly feasible. Though users had not opted to enable multi-factor authentication (MFA) as a mechanism to detect mitigate against this type of attack themselves.

One point that does stand out to me is that these accounts had access to 6.9 million people’s data.  This seems like a staggeringly high blast radius, though does also make me question how much of the data would have been accessible to the attacker if, instead of using compromised accounts to gain access, they had signed up legitimately to the platform? And from this, were users provided with sufficient information to provide informed consent? And what boundaries, if any, come with that consent?

While this data loss and its impact has been a result of obvious malicious intent, with the threat actor selling individual records for between $1 and $10 USD on the darkweb; in 2020 the private equity firm “Blackstone” bought the DNA testing company Ancestry for $4.7 billion USD and in 2019 users of Family Tree DNA, a similar platform/service provider, found that their genetic sample, data, and by extension that of their relatives, was being used by the FBI. How are users therefore supposed to analyze, understand, accept, and control the risk of who has access to their data?

The broader point that I would like to see judgement on is where the balance point is between users having to take responsibility for their own password management, data, and cybersecurity and companies securing, monitoring, and responding to detections on their systems.

Ultimately, while I don’t expect these cases to answer all of the questions, or necessarily lay precedent for future actions, there has to come a point where users and providers work together to create a clear understanding of risk, consent, and responsibility.

Mark Cunningham-Dickie is a Senior Incident Responder for Quorum Cyber.