Data you can't change

If someone steals your password, you change it. If someone steals your card, you block it and a few days later you have a new one. Annoying, but fixable.

What if what leaks is your DNA? There’s no “change” button. Once it’s out, it’s out, and it doesn’t only affect you.

What happened

In October 2023, 23andMe, one of the best-known genetic testing companies, confirmed that attackers had accessed customer data. In early December it gave the figures: the attackers had broken directly into around 14,000 accounts, about 0.1% of the total.

What stands out is how they got in. They didn’t break into the company’s systems. They used email and password combinations leaked from other services, and tried them one by one. It worked for people who had reused the same password and hadn’t turned on two-step verification.

From those accounts, a feature designed to help people find relatives gave them access to information about many others. In all, the data of around 6.9 million users was exposed: almost half of the company’s customers.

Data that never expires

This story leaves a very useful distinction. Some data can be changed: passwords, cards, addresses, even your phone number. And some can’t: your DNA, your fingerprint, your face, your date of birth.

With the first kind, a leak is a temporary problem. With the second, it’s forever. A fingerprint leaked today will still be your fingerprint forty years from now.

DNA has one more peculiarity: it isn’t only yours. It shares information with your parents, siblings, children and cousins, none of whom gave their consent. Whoever hands over their DNA partly hands over their family’s too.

Fourteen thousand accounts, millions of people

The most instructive part of the case is the imbalance. A few thousand reused passwords ended up exposing millions of people who had done nothing wrong.

The key was the sharing features. Finding relatives is one of the reasons people use these services, and to make it possible, each user could see part of the others’ information. Getting into one account was enough to peek into hundreds of others.

Any product with social features has this same property: each user’s security depends a little on everyone else’s.

How to protect yourself

A few habits make a big difference.

A different password for every service. Nobody can remember them all, and you don’t need to: a password manager does it for you.

Two-step verification wherever possible. Even if someone gets your password, they can’t get in without the second step. In this case, it would have been enough to stop the attack.

Think twice before handing over data you can’t change. A genetic test, a fingerprint to unlock an app, a photo of your face to verify your identity. Sometimes it’s worth it; it’s best when it’s a conscious decision.

Check what you share with other users. Visibility settings tend to be tucked away, and they’re rarely set to the most private option by default.

The lesson for builders

Whoever designs a product can prevent a good share of these problems.

Don’t store data that can never be changed unless you need it. Make private the default, especially in features that share information between users. And when the data deserves it, require two-step verification instead of leaving it as an option almost nobody turns on.

Forever

A password is a key: if you lose it, you change the lock. Your DNA, your face or your fingerprint are the lock itself.

That’s why they deserve different treatment, both from those who hand them over and from those who keep them. Privacy isn’t about hiding anything: it’s about deciding what stays in other people’s hands forever.