how it happened
- whoattackersold breach password lists
- the gapreused passwords~14,000 accounts opened
- thenlinked profilesone account reads its relatives
- the result6.9M people exposed$30M settlement
what everyone assumed
A platform offers two-step verification and recommends a strong, unique password, and from there the account is the customer’s to protect. This is a reasonable division of labor, and it is how almost every consumer service draws the line. The login form cannot tell whether the person typing knows the password or merely bought it.
what happened
From roughly April into September, attackers worked through lists of email-and-password pairs leaked from older, unrelated breaches, trying them one at a time. Most failed. About 14,000 accounts opened, because the people behind them had reused a password that was already circulating. Each successful login was, by the system’s own measure, a normal customer signing in.
step by step
- April to September 2023old leaked passwords are tried one by oneAttackers work through email and password pairs from unrelated breaches. Most fail.
- about 14,000 accounts openTheir owners had reused a password that was already circulating. Each login looks like a normal customer.
- DNA Relatives and Family Tree widen the reachOne opened account can read the shared profile data of everyone it is connected to.the assumption breaks here
- data tied to about 6.9 million people is exposedAround 5.5 million through DNA Relatives and 1.4 million through Family Tree. A 30 million dollar settlement follows.
how it surfaced
The 14,000 accounts were never the point. A feature called DNA Relatives let one opened account read the shared profile data of everyone it was connected to, and Family Tree extended the reach further. Through those 14,000 doors, information tied to roughly 6.9 million people was exposed, around 5.5 million through DNA Relatives and 1.4 million through Family Tree. The company later agreed to a 30 million dollar settlement.
When one account can read across the network to thousands of others, the password on that single account stops being a personal matter and becomes a structural one.
picture it at a company like yours
The company here is made up. The other two paths are not: they happened, and each links to the story.
- in this storythe day it mattersSomeone feeds in a list from an old, unrelated breach. A few dozen accounts open, each looking like a normal login.what it costs youEvery opened account can see shared project files, so a handful of logins becomes most of your client list.
- or it goes like thisit happenedThe Snowflake wave, 2024howAn old password opens a data store that never required a second step.what leavesthe whole database in one downloadwho ends up with itan extortion group
- or it goes like thisit happenedChange Healthcare, 2024howA stolen password gets through the one remote-access door without a code.what leavescontrol of the systems customers rely onwho ends up with ita ransomware crew
sources
your turn
what you can do about it
this week
Find the place in your product where one compromised account reaches the most other people's data, and ask what currently stands between a reused password and that reach.
Your product almost certainly has a feature where one account can see data belonging to other accounts: a shared workspace, a team directory, a relationship graph, an org-wide search. The assumption to retire is that account security ends at each individual login. The honest answer is often a single login form that cannot tell the difference.
go deeper
if you're not sure where to start
Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.
open the checklist →