Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Breach exposed more than one million DNA profiles on a major genealogy database

buzzfeednews.com

Post reply on HN
Print view View original

31–40 of 424 posts

Re: Breach exposed more than one million DNA profiles on a major genealogy database

#31

Post by MattGaiser »

slg wrote: post #27

Can someone explain the potential short to medium term fears of one's DNA leaking? My initial assumption is that it would be less of a problem compared to nearly any other personal data leaking. Like it certainly sounds creepy, but credit card or other financial data being stolen presents a huge headache and creates a lot of work. I understand that in specific instances, for example when paternity is in question or i…

I may be one of the people who lost DNA in this breach.

I am not currently worried about anything, but I also know that I don’t know everything DNA can be used for. My greatest concern consists of things some smart crook might think of doing.

While a reputable company might not use the DNA for fear of getting sued, they might use a crappy contractor who does not care.

Banks care about information security and take it seriously. They use a crappy contractor called Equifax which doesn’t.

Re: Breach exposed more than one million DNA profiles on a major genealogy database

#32

Post by zitterbewegung »

thephyber wrote: post #22

As someone who works in cybersecurity, it's always hard for me to interpret PR language like "orchestrated through a sophisticated attack". This could be aimed towards non-savvy readers meaning basically anything or it could be accurate and describe a nation-state (although I don't get the feeling of a sophisticated nation-state actor here). The DoJ used similar wording when prosecuting Aaron Schwartz for using Pytho…

Just wait until Krebs on Security talks about it.

Re: Breach exposed more than one million DNA profiles on a major genealogy database

#33

Post by mej10 »

philmcc wrote: post #30
slg wrote: post #27

Can someone explain the potential short to medium term fears of one's DNA leaking? My initial assumption is that it would be less of a problem compared to nearly any other personal data leaking. Like it certainly sounds creepy, but credit card or other financial data being stolen presents a huge headache and creates a lot of work. I understand that in specific instances, for example when paternity is in question or i…

My hunch is that if this information is used against you, you'd never know. First scenario that comes to mind: The insurance company that gives you an extremely high quote because you come back as "high risk" from a 3rd party company that they use to vet applications, and that 3rd party company uses your genetic predisposition for a condition.

For what it's worth, that is illegal in the USA at least. Genetic Information Nondiscrimination Act passed in 2008.

Re: Breach exposed more than one million DNA profiles on a major genealogy database

#34

Post by slg »

philmcc wrote: post #30
slg wrote: post #27

Can someone explain the potential short to medium term fears of one's DNA leaking? My initial assumption is that it would be less of a problem compared to nearly any other personal data leaking. Like it certainly sounds creepy, but credit card or other financial data being stolen presents a huge headache and creates a lot of work. I understand that in specific instances, for example when paternity is in question or i…

My hunch is that if this information is used against you, you'd never know. First scenario that comes to mind: The insurance company that gives you an extremely high quote because you come back as "high risk" from a 3rd party company that they use to vet applications, and that 3rd party company uses your genetic predisposition for a condition.

This requires the insurance company to be doing something illegal and for it to really cause damage all their competitors have to be doing it as well. If this ever becomes widespread, it would be quickly obvious when a large number of ostensibly healthy people are given quotes that match their genetic profile but not their medical history. I'm just not sure that is a reasonable fear.

Re: Breach exposed more than one million DNA profiles on a major genealogy database

#36

Post by harimau777 »

MattGaiser wrote: post #20
tossmeout wrote: post #13

There should be fines big enough to bankrupt the companies who fail to secure data this kind of data. Is there some other way to convince them to take the issue more seriously?

That just pushes them offshore. I would rather that there be greater security training in software development programs/bootcamps. I’m a software engineer. I know a lot of software engineers. None of us have ever been trained in security. Any “best practices” are usually picked up in Stack Overflow conversations.

It seems to me that the way to deal with offshoring would be to bring back a modern version of outlawery. The US could basically declare: "Until this corporation pays their fines the US will not prosecute or extradite any individual or corporation who hacks them, steals their physical or intellectual property, declares debts to them canceled, or violates contracts with them."

Re: Breach exposed more than one million DNA profiles on a major genealogy database

#37

Post by kbenson »

anderspitman wrote: post #19
loughnane wrote: post #3

This is why I’ve been putting off getting my genome sequenced. One breach and it’s out there forever. I’ve heard good things about nebula[0] as a way to get an anonymous genome but have yet to be motivated enough to take the plunge [0] https://nebula.org/whole-genome-sequencing/

Nebula is definitely an interesting entry into the market. There's also Dante Labs[0], which often offers 30x whole genome in the 200-300USD range. You can download all your raw data (including FASTQs, h37-aligned BAMs, and VCFs) from AWS. There are some quality concerns (and they use BGI instead of Illumina sequencers), but at that price it's tempting to do Dante and Nebula as a check on each other. Dante also has w…

> including an option to destroy your saliva sample

Until I read that sentence, it honestly never occurred to me they would keep that around. The data, sure. Biological samples? I just assumed they would be disposed of after use.

Re: Breach exposed more than one million DNA profiles on a major genealogy database

#38

Post by game_the0ry »

thephyber wrote: post #22

As someone who works in cybersecurity, it's always hard for me to interpret PR language like "orchestrated through a sophisticated attack". This could be aimed towards non-savvy readers meaning basically anything or it could be accurate and describe a nation-state (although I don't get the feeling of a sophisticated nation-state actor here). The DoJ used similar wording when prosecuting Aaron Schwartz for using Pytho…

I think you interpreted this dishonest PR spin just fine.

Re: Breach exposed more than one million DNA profiles on a major genealogy database

#39

Post by sk5t »

mej10 wrote: post #33
philmcc wrote: post #30

Earlier quoted context omitted.

My hunch is that if this information is used against you, you'd never know. First scenario that comes to mind: The insurance company that gives you an extremely high quote because you come back as "high risk" from a 3rd party company that they use to vet applications, and that 3rd party company uses your genetic predisposition for a condition.

For what it's worth, that is illegal in the USA at least. Genetic Information Nondiscrimination Act passed in 2008.

Which covers health insurance, not life insurance and others.

Re: Breach exposed more than one million DNA profiles on a major genealogy database

#40

Post by bagacrap »

slg wrote: post #27

Can someone explain the potential short to medium term fears of one's DNA leaking? My initial assumption is that it would be less of a problem compared to nearly any other personal data leaking. Like it certainly sounds creepy, but credit card or other financial data being stolen presents a huge headache and creates a lot of work. I understand that in specific instances, for example when paternity is in question or i…

this presentation outlines the kind of terrible attacks that could be based on your DNA in the near future https://youtu.be/HKQDSgBHPfY

tldr, CRISPR allows targeting bioweapons at specific individuals.

Post reply on HN