DNA analysis service GEDmatch suffers breach exposing 1.3 million DNA profiles

Why it matters: Private DNA profiling companies like GEDmatch have surged in popularity by offering people the ability to explore their family histories and health risks. Lately, many of these companies have begun expanding into the forensic genomics market to create DNA profiles for law enforcement, often without a solid cybersecurity strategy in place to protect the users' data.

On July 19, a major security breach prompted the owners of DNA analysis service GEDmatch to take the website offline. After a preliminary investigation, it was revealed that a treasure trove of DNA profiles had been made available for law enforcement searches (and by extension, all other users of the service).

The incident exposed no less than 1.3 million DNA records from its database. The company confirmed as much on its Facebook page, and described it as "a security breach orchestrated through a sophisticated attack on one of our servers via an existing user account."

GEDmatch allows users to upload their DNA profiles to help trace their ancestry tree. The breach was made possible by the fact that users can opt-in to have their data shared with law enforcement. This was supposed to be a privacy control, as the service was used in 2018 to find the identity of the infamous "Golden State Killer."

In a public statement, the company explained the breach merely resulted in user permissions being reset, with no actual user data being compromised or downloaded. However, DNA testing company MyHeritage reported on Tuesday that its user had been the targets of a phishing attack that may be connected to the GEDmatch ..

Support the originator by clicking the read the rest link below.