MyHeritage suffers massive data leak affecting 92m users

No signs hackers have got hold of user data, says DNA testing firm

The email addresses of more than 92 million MyHeritage users were recently exposed via a private server outside of the company's control, it revealed yesterday, as it launches an investigation into the breach.

The US-based geneology platform admitted the breach eight hours after an anonymous security researcher sent it a file containing the email addresses of 92,283,889 users who'd signed up to the service by 26 October 2017, representing 96% of its userbase, along with their hashed passwords.

Advertisement - Article continues below

MyHeritage believes the leak was limited to email addresses, as it doesn't store passwords; rather it stores a one-way hash of each password, in which the hash key differs for each customer. Its information security incident response team is still investigating the breach, but does not have an update regarding the source of the leak.

While it hasn't revealed where the private server in question was, it said there is no evidence that any hackers ever accessed the data stored on it.

The company said it had no reason to believe any other systems were compromised, and had not seen any activity indicating accounts were compromised as a result of the leak. Sensitive information, such as family tree or DNA data, are stored on segregated systems separate from the servers that store email addresses, and are fitted with additional layers of security.

Advertisement
Advertisement - Article continues below

"Immediately upon learning about the incident, we set up an Information Security Incident Response Team to investigate the incident," wrote chief information security officer Omer Deutsch on a post on the company's website.

Advertisement - Article continues below

"We are also taking immediate steps to engage a leading, independent cybersecurity firm to conduct comprehensive forensic reviews to determine the scope of the intrusion, and to conduct an assessment and provide recommendations on steps that can be taken to help prevent such an incident from occurring in the future."

Deutsch added in a follow-up post published today that "from the moment this became known to us we have been working literally around the clock, taking additional steps to help protect our users". 

He also outlined how the company intends to bolster its security measures in future, including rolling out two-factor authentication to its users, as well as setting up a 24/7 security customer support team to assist users with concerns about the incident.

Meanwhile, MyHeritage said it has reported the leak to the relevant authorities in light of the EU's General Data Protection Regulation (GDPR), and has begun the process of force-expiring all user passwords, with more than half of user accounts now expired. Furthermore, the company is preparing to contact affected users individually via email.

Advertisement - Article continues below

The scale of the breach is comparable to a similar breach affecting 150 million MyFitnessPal users earlier this year - considered one of the largest in history - in which attackers stole usernames, email addresses, and hashed passwords.

Although data breaches have been on the rise globally, findings published in April suggest that leaks originating from UK organisations have declined, with 40% fewer data records stolen or compromised in 2017 against the previous year.

Picture: Bigstock

Featured Resources

Top 5 challenges of migrating applications to the cloud

Explore how VMware Cloud on AWS helps to address common cloud migration challenges

Download now

3 reasons why now is the time to rethink your network

Changing requirements call for new solutions

Download now

All-flash buyer’s guide

Tips for evaluating Solid-State Arrays

Download now

Enabling enterprise machine and deep learning with intelligent storage

The power of AI can only be realised through efficient and performant delivery of data

Download now
Advertisement

Recommended

Visit/security/vulnerability/355236/hp-support-assistant-flaws-leave-windows-devices-open-to-attack
vulnerability

HP Support Assistant flaws leave Windows devices open to attack

6 Apr 2020
Visit/security/cyber-security/355234/safari-bug-let-hackers-access-cameras-on-iphones-and-macs
cyber security

Safari bug let hackers access cameras on iPhones and Macs

6 Apr 2020
Visit/software/video-conferencing/355229/zoom-we-moved-too-fast
video conferencing

Zoom CEO admits company "moved too fast" as privacy issues mount

6 Apr 2020
Visit/security/internet-security/355228/mozilla-fixes-two-firefox-zero-days-being-actively-exploited
internet security

Mozilla fixes two Firefox zero-days being actively exploited

6 Apr 2020

Most Popular

Visit/mobile/mobile-phones/355239/microsofts-patent-design-reveals-a-mobile-device-with-a-third-screen
Mobile Phones

Microsoft patents a mobile device with a third screen

6 Apr 2020
Visit/development/application-programming-interface-api/355192/apple-buys-dark-sky-weather-app-and-leaves
application programming interface (API)

Apple buys Dark Sky weather app and leaves Android users in the cold

1 Apr 2020
Visit/software/video-conferencing/355229/zoom-we-moved-too-fast
video conferencing

Zoom CEO admits company "moved too fast" as privacy issues mount

6 Apr 2020