23andMe gets hacked, then tries to screw its customers

[thewayne]

In October, the gene testing company got hacked. The information on 7,000,000 customers was compromised. From the article, the information compromised includes: "photos, full names, geographical location, information related to ancestry trees, and even names of related family members. The company said that no genetic material or DNA records were exposed. Days after that attack, the hackers put up profiles of hundreds of thousands of Ashkenazi Jews and Chinese people for sale on the internet."

Of course, law suits started popping up immediately. Back to the article: "multiple class action claims” have already been against the company in both federal and state court in California and state court in Illinois, as well as in Canadian courts." No surprise there.

Here's the surprise.

23 sent out an update to its terms of service to all customers. Okay, that's not new, companies do it all the time and usually we ignore them. These were a bit different. Just a wee bit.

First off, unless you notified them in writing within 30 days, you automatically agreed to them.

Second, by agreeing to them, you relinquished your right to participate in class action claims.

GEE, ISN'T THAT SPECIAL?! Company gets hacked, then screws over their customers to try to prevent them from suing the company. Pretty clever. One law professor said that the change in the user agreement would not be enough to prevent claims, but the article did not go into any detail of the reasoning behind the statement. Perhaps some ex post facto going on there?

Myself, while I have had genetic testing performed, it was purely in a medical context and theoretically my genes have never been shared with companies like this. They are far too liberal with sharing their information and with letting law enforcement stroll through their data.

https://www.engadget.com/23andme-frantically-changed-its-terms-of-service-to-prevent-hacked-customers-from-suing-152434306.html

Comments

[silveradept]

Just trying that move should have gotten a governmental regulator breathing fire down their necks for such a transparent attempt at dodging the responsibility for the hack and the data exfiltration. And then further firebreathing about the hack and the data exfiltration itself. But there probably isn't one in the States that can put the fear of Mod into them.