In an email sent to customers earlier this week viewed by Engadget, the company announced that it had made updates to the “Dispute Resolution and Arbitration section” of its terms of service that would prevent customers from filing class action lawsuits.
This “hack” is being blown way out of proportion. No 23andme systems were compromised, a bunch of customer accounts were accessed using reused passwords found in password leaks from other sites. I think the only real change 23andme could implement here would be to enforce 2fa across all accounts, but they’re certainly not alone in that.
Except that’s not true. Somehow, 23andme missed the almost certainly anomalous activity on thier network that lead to the extraction of 6.9 million users’ data. Missing the activity associated with the massive data dump, designing thier system to allow for that? 100% thier fault.
One should not be able to use a set of hacked accounts to dump that much data. That’s a design fkaw.