What should a website do when you present it with correct credentials?
Not then give you access to half their customers' personal info?
Credential stuffing 1 grandpa who doesn't understand data security shouldn't give me access to names and genetics of 500 other people.
That's a shocking lack of security for some of the most sensitive personal data that exists.
It's at least 99.8% the company's fault.
Even if we blame those 14k password reusers, we're blaming 1 in every 500 victims. Being able to access genetic information and names of 6.9 million people - half your entire customers! - by hacking 0.02% of that is the fault of the company. They structured that access and failed to act on the obvious threat it represents.
But why blame password reusers? Not every grandparent interested in their family tree is capable of even understanding data security, let alone juggling multiple passwords or a PW manager.
Credential stuffing is an inevitable part of security landscape - especially for one time use accounts like genetics sites. A multimillion dollar IT department is just clearly responsible for preventing egregious data security failures.
I’m honestly asking what the impact to the users is from this breach.
The stolen info was used to databases of people with jewish ancestry that were sold on the dark web. I think there was a list of similar DB of people with chinese ancestry. 23andme's poor security practices have directly helped violent white supremecists find targets.
If you're so incompetent that you can't stop white supremecists from getting identifiable information about people from minorities, there is a compelling public interest for your company to be shut down.
I'm sure he did make games worse, but he also covered up for rapists and threatened to kill employees which seems maybe more headline worthy to me.
It sounds like every step of the way, on multiple sites, everyone you've interacted with has told you they find your tone combative and your behavior unacceptable.
Usually, when everyone around you in multiple different contexts tells you you're wrong, you're probably wrong.
The easiest way to tell that something's not really innovative is if the person describing it uses the word innovative.
Tell me you didn't read the article without telling me.
If 14,000 users who didn't change a password on a single use website they probably only ever logged into twice gives you 6.9 million user's personal info, that's the company's fault.