Federal class action lawsuit looms as genetics company searches for what went wrong; a reminder to clinical laboratories of the importance of protecting patient information
Several years ago, security experts warned that biotechnology and genomics company 23andMe, along with other similar genetics companies, would be attacked by hackers. Now those predictions appear to have come true, and it should be a cautionary tale for clinical laboratories. In an October 6 blog post, the genetic testing company confirmed that private information from thousands of its customers was exposed and may be being sold on the dark web.
According to Wired, “At least a million data points from 23andMe accounts appear to have been exposed on BreachForums.” BreachForums is an online forum where users can discuss internet hacking, cyberattacks, and database leaks, among other topics.
“Hackers posted an initial data sample on the platform BreachForums earlier this week, claiming that it contained one million data points exclusively about Ashkenazi Jews,” Wired reported, adding that “hundreds of thousands of users of Chinese descent” also appear to be impacted.
The leaked information included full names, dates of birth, sex, locations, photos, and both genetic and ancestry results, Bleeping Computer reported.
For its part, 23andMe acknowledges the data theft but claims “it does not see evidence that its systems have been breached,” according to Wired.
Anne Wojcicki (above) is the co-founder and CEO of genetics company 23andMe, which on October 24 told its customers in an email, “There was unauthorized access to one or more 23andMe accounts that were connected to you through DNA Relatives. As a result, the DNA Relatives profile information you provided in this feature was exposed to the threat actor.” Clinical laboratories must work to ensure their patient data is fully secured from similar cyber theft. (Photo copyright: TechCrunch.)
23andMe Claims Data Leak Not a Security Incident
The data leaked has been confirmed by 23andMe to be legitimate. “Threat actors used exposed credentials from other breaches [of other company’s security] to access 23andMe accounts and steal the sensitive data. Certain 23andMe customer profile information was compiled through access to individual 23andMe.com accounts,” a 23andMe spokesperson told Bleeping Computer.
However, according to the company, the leak does not appear to be a data security incident within the 23andMe systems. “The preliminary results of this investigation suggest that the login credentials used in these access attempts may have been gathered by a threat actor from data leaked during incidents involving other online platforms where users have recycled login credentials,” the spokesperson added.
What the genetics company has determined is that compromised accounts were from users choosing the DNA Relative feature on their website as a means to find and connect to individuals related to them. Additionally, “the number of accounts sold by the cybercriminal does not reflect the number of 23andMe accounts breached using exposed credentials,” Bleeping Computer noted.
Price of Private Information
Following the 23andMe data leak, the private genetic information was quickly available online … for a price.
“On October 4, the threat actor offered to sell data profiles in bulk for $1-$10 per 23andMe account, depending on how many were purchased,” Bleeping Computer reported.
Stolen medical records are becoming hotter than credit card information, the experts say. “Stolen records sell for as much as $1,000 each,” according to credit rating agency Experian, Bleeping Computer noted.
Clinical laboratory managers and pathologists should take note of the value that the dark web places on the medical records of a patient, compared to the credit card numbers of the same individual. From this perspective, hacking a medical laboratory to steal patient health data can be much more lucrative than hacking the credit card data from a retailer.
“Victims of the breach are now at increased risk of fraud and identity theft, and have suffered damages in the form of invasion of privacy, lost time and out-of-pocket expenses incurred responding to the breach, diminished value of their personal information, and lost benefit of the bargain with 23andMe,” according to court documents.
“The lawsuit brings claims of negligence, breach of implied contract, invasion of privacy/intrusion upon seclusion, unjust enrichment, and declaratory judgment,” Bloomberg Law noted. Additionally, the claim states that 23andMe “failed to provide prompt and adequate notice of the incident.”
Plaintiffs are “seeking actual damages, compensatory damages, statutory damages, punitive damages, lifetime credit-monitoring services, restitution, disgorgement, injunctive relief, attorneys’ fees and costs, and pre-and post-judgment interest,” Bloomberg Law reported.
Preventing Future Data Leaks
Years of experts warning genetics companies like 23andMe that they need more strict data security have proven to be true. “This incident really highlights the risks associated with DNA databases,” Brett Callow, a threat analyst at data security firm Emsisoft, told Wired. “The fact that accounts had reportedly opted into the ‘DNA Relatives’ feature is particularly concerning as it could potentially result in extremely sensitive information becoming public.”
“Callow notes that the situation raises broader questions about keeping sensitive genetic information safe and the risks of making it available in services that are designed like social networks to facilitate sharing. With such platforms come all of the data privacy and security issues that have plagued traditional social networks, including issues related to data centralization and scraping,” Wired noted.
Clinical laboratory databases are full of protected health information (PHI). Wise lab managers will work to ensure that their medical lab’s patient data is secure from today’s cyberthreats.
Clinical laboratory scientist who aided in the investigation compared DNA test results with publicly available genetic information
In an interesting twist in the solving of crime, genetic test results—along with help from a clinical laboratory scientist (CLS) turned amateur genealogist—guided relatives of Melissa Highsmith to her whereabouts after she was allegedly kidnapped as a toddler over half a century ago. According to The Guardian, the CLS helped locate Melissa by “interpreting the key DNA results and mining publicly available records.”
Highsmith’s abduction was one of the oldest missing person cases in the country and demonstrates how clinical laboratory skills can be applied outside the laboratory to help solve other problems—in this case, helping a family search for a kidnapped daughter—using genetic testing technologies that until recently were not available to the general public.
Thanks to a 23andMe at-home DNA test—and a tenacious clinical laboratory scientist/amateur genealogist—Melissa Highsmith (shown above at time of kidnapping and today) has been reunited with her birth family. This shows how genetic testing is being used in remarkable ways outside of the clinical laboratory. (Photo copyright: Highsmith family/People.)
Back in 1971, Melissa’s mother, Alta Apantenco, placed an advertisement in a local newspaper in Fort Worth, Texas, to hire a babysitter to care for her 21-month-old daughter. Apantenco hired Ruth Johnson to babysit her daughter without meeting the woman in person. Because Apantenco had to be at work, the child was handed over to Johnson by Apantenco’s roommate. The babysitter then allegedly abducted Melissa and disappeared with her.
Melissa’s family reported her missing to the police and searched for the snatched baby for more than 51 years. The family even organized a Facebook page called “Finding Melissa Highsmith” and sought outside assistance from the National Center for Missing and Exploited Children (NCMEC) in locating their lost relative, according to the New York Post.
The police and the FBI also got involved in the case, but few leads emerged over the decades.
Then, in September of 2022, Melissa’s family received a new lead regarding her location based on her father’s 23andMe DNA test results. Those results, along with a birthmark and date of birth, confirmed that Melissa was alive and well and residing in the Charleston, South Carolina area.
Over Thanksgiving weekend, Melissa was reunited with her mother, her father Jeffrie Highsmith, and two of her four siblings at a church in Fort Worth. She hopes to meet her remaining two siblings over the Christmas holidays.
“I can’t describe my feelings. I’m so happy to see my daughter that I didn’t ever think I would see again,” Apantenco told Saint Paul, Minnesota, television station KSTP.
“I couldn’t stop crying,” said Melissa’s sister Victoria Garner in a family statement. “I was overjoyed, and I’m still walking around in a fog trying to comprehend that my sister [was] right in front of me and that we found her,” The Guardian reported.
Clinical Laboratory Scientist Aids in the Investigation
The 23andMe test results alerted the family to the existence of a few unknown relatives that could be connected to the DNA of Melissa’s father. The family then contacted a genealogist and clinical laboratory scientist from Minnesota named Lisa Jo Schiele to help them interpret the results and potentially locate the missing woman. Schiele compared the DNA results with public records to help find Melissa Highsmith.
“I was able to use what we call traditional genealogy to find marriage records and things like that to find where Melissa was right now,” Schiele told KSTP. “At first glance, you look at these matches, but I’m like, ‘Holy cow, is this too good to be true?’ I’m very happy to help them navigate all of this.”
One of Melissa’s sisters, Sharon Highsmith, stated that her mother experienced deep feelings of guilt after Melissa’s abduction and had even faced accusations that she had something to do with the disappearance of her daughter.
“My mom did the best she could with the limited resources she had. She couldn’t risk getting fired, so she trusted the person who said they’d care for her child,” Sharon said in a family statement. “I’m grateful we have vindication for my mom,” The Guardian reported.
“I keep having to pinch myself to make sure I’m awake,” Melissa, who now resides in Fort Worth, told KSTP.
“It’s a miracle,” Apantenco said.
“A Christmas miracle,” Melissa added.
Due to the statute of limitations, which expired 20 years after Melissa turned 18, the babysitter who allegedly took Melissa cannot be criminally prosecuted.
“I’m angry our family was robbed for 51 years,’’ Melissa told Fort Worth news station WFAA.
This remarkable story illustrates how clinical laboratory skills combined with genetic testing results can be used outside of medical laboratory testing purposes to aid in solving criminal cases and other mysteries involving missing people.
Further advances in DNA testing combined with genetic databases that include DNA from greater numbers of people could result in more reunions involving missing persons who were identified because of genetic matching.
Clinical laboratories and pathology groups can benefit from knowing how genetic testing is being used for other than medical testing purposes
It is useful for pathologists and clinical laboratory managers to be aware of the different ways genetic testing and DNA sequencing is being conducted. That’s because a genetic test for one purpose—such as identifying an individual’s relatives and connection to a region or a cultural group—might generate data that could become part of that person’s medical care.
Thus, an ongoing genetic study in South Africa highlighting the issue of so-called “helicopter research” will be informative for Dark Daily’s readers.
Also known as “neo-colonial science,” helicopter research describes when scientists from wealthy countries perform research in lower-income countries in ways that may be deemed exploitative or disrespectful to local populations.
“Scientists conduct helicopter research when they collect data from developing countries and marginalized communities with little to no involvement from local researchers and community members,” wrote researchers Dana Al-Hindi, and Brenna Henn PhD, in an article for The Conversation. “Helicopter research also occurs when researchers take data out of the country they collected it from without either providing benefit to or sharing the results with the community.”
In an article for The Conversation, UC Davis researchers Brenna Henn, PhD (left), and Dana Al-Hindi (right), wrote, “While we have learned a great deal from these communities, we have been unable to fulfill a common request: providing them their individual genetic ancestry result. In our attempts to overcome the logistical challenges of providing this information, we’ve grappled with the common question of how to ensure an equitable balance of benefits between researchers and the community they study. What we’ve found is that there is no easy answer.” Clinical laboratories will want to remember the term “Helicopter Research” in relation to these types of studies. (Photos copyright: UC Davis/The Conversation.)
The South Africa study, conducted over the past 12 years, aims to use genetic data “to help unravel the history and prehistory of southern Africans and their relationship to populations around the world,” the authors wrote in The Conversation.
The researchers have been using the genetic data to trace the ancestry of indigenous Khoekhoe and San peoples in South Africa as well as other populations that self-identify as “Colored.”
“Early European colonizers initially used this term to refer to indigenous Khoekhoe and San groups long before it was codified by the apartheid government in 1948,” the researchers wrote. “It persists today as an ethnic category, broadly encompassing Khoe-San groups, various East African, Indian, and Southeast Asian populations brought by the slave trade, and people of mixed ancestry.”
Challenges Sharing Genetic Data with Study Participants
Participants in the study have asked to see their personal genetic ancestry results, but the researchers noted several challenges, including local restrictions and the difficulty of presenting complex data in “an accessible and digestible form.” So, the researchers partnered with consumer-focused genetic testing company 23andMe (NASDAQ:ME).
23andMe provided additional funding for the research, assisted the researchers in community outreach, and “expanded our ability to ‘capacity-build’—that is, to make sure that the knowledge and skills we gain are shared with local institutions,” Henn and Al-Hindi wrote in The Conversation. They added that they are still dealing with questions about whether their efforts to provide equitable benefits are sufficient.
“Our research team, local collaborators, and 23andMe are all concerned about how to best address the risk of helicopter research, coercion, and any unknown risks that may arise from disclosing personal ancestry results,” they wrote.
Cape Town Statement on Fostering Research Integrity
The issue of helicopter research was a major focus at the 7th World Conference on Research Integrity (WCRI), held May 29-June 1 in Cape Town, South Africa. It was the first WCRI to be held in Africa and adopted the theme “Fostering Research Integrity in an Unequal World.”
One outcome of the conference will be an effort to produce what is known as the Cape Town Statement on Fostering Research Integrity. The statement will “highlight the importance of fairness in international research partnerships,” noted Research Professional News.
The statement “compels institutions and researchers alike to act on their responsibilities to promote equity, diversity, and fairness in research partnerships,” conference speaker Retha Visagie, DCur, told the publication. She leads the Research Integrity Office at the University of South Africa.
Conference co-chair Lyn Horn, PhD, director the Office of Research Integrity at the University of Cape Town, told the publication that it could take up to a year before a draft of the statement is ready for comment.
One overarching goal will be to “demonstrate why inequity and unfair practices in research collaborations and contexts is a research integrity (RI) matter,” the authors wrote. “Second it must identify some key values or principles and action guides that will address the issue of equity and fairness in research within the context of the complete research life cycle from research agenda setting and call to proposal development, through grant application, allocation and management of funding, data production, analysis, management and sharing, to outputs, translation, and evaluation.”
Another conference speaker, Francis Kombe PhD, told attendees the statement will offer guidance specifically to institutions such as universities, journals, and funding organizations, the journal Science reported. That stands in contrast to earlier statements on helicopter research, which were geared more toward individuals and small groups.
How any of this will impact clinical laboratories and pathology groups remains unclear. Nevertheless, it is worthwhile knowing how gene sequencing is being used by researchers for purposes other than to guide diagnoses and treatment of patients.
This new knowledge about the human genome may lead to a new set of biomarkers and clinical laboratory tests for predisposition to this health condition
Researchers across the globe are working to understand why some people who become infected with the SARS-CoV-2 coronavirus experience loss of smell (anosmia) and taste (ageusia) often for months following recovery from COVID-19 infection.
Now, pathologists and medical laboratory managers will be interested to learn that scientists from DNA testing company 23andMe believe they have identified a genetic risk factor associated with the condition. The discovery could lead to a new set of biomarkers for predisposition to loss of taste or smell that could help experts develop improved precision medicine treatments for similar conditions.
“Early data suggests that supporting cells of the olfactory epithelium are the ones mostly being infected by the virus and presumably this leads to the death of the neurons themselves. But we don’t really know why and when that happens, and why it seems to preferentially happen in certain individuals,” he added.
To perform their study, the 23andMe researchers examined the genetic tests of 69,841 individuals who self-reported that they had received a positive COVID-19 test. 68% of those people stated that they had experienced either loss of smell or taste as part of their symptomology of the illness. All the participants in the survey reside in either the United States or the United Kingdom.
After contrasting the genetic differences between those who experienced loss of taste or smell as a symptom of COVID-19 and those who did not, the team discovered a region of the genome associated with a spot located near the UGT2A1 and UGT2A2 genes. These two genes are expressed within tissue in the nose and are involved in smell and the metabolization of odorants.
It’s unclear if or how UGT2A1 and UGT2A2 genes may be involved in the process that leads to loss of taste or smell, but the 23andMe researchers hypothesize the genes may play a role in the physiology of infected cells which leads to the impairments.
The team found that 72% of female respondents reported loss of taste or smell as a symptom of COVID-19, which was higher than the 61% of male respondents who reported the same symptoms. In addition, the respondents who reported loss of taste or smell were typically younger than those who did not report those symptoms and persons of East Asian or African American ancestry were significantly less likely to report those symptoms.
An earlier study, titled, “Growing Public Health Concerns of COVID-19 Chronic Olfactory Dysfunction,” which appeared in the journal JAMA Otolaryngology-Head and Neck Surgery, stated that six months after contracting COVID-19 as many as 1.6 million people in the US experienced either lingering changes to their ability to smell or a complete loss of that sense.
Helping Patients Understand Why They Were Affected
Experts believe 23andMe’s findings may help patients deal with loss of taste or smell after a COVID-19 infection and increase the chance of finding suitable treatments.
“It answers the question of ‘why me’ when it comes to taste and smell loss with COVID-19,” Danielle Reed, PhD, Associate Director, Monell Chemical Senses Center, told USA Today. “Some people have it and some do not. Inborn genetics may partially explain why.”
Earlier research suggested the loss of these senses was related to a failure to protect the sensory cells of the nose and tongue from the viral infection. But according to Reed, the 23andMe study findings suggest a different cause.
“The pathways that break down the chemicals that cause taste and smell in the first place might be over or underactive, reducing or distorting the ability to taste and smell,” she said.
The 23andMe researchers noted their study had a few limitations:
It was biased towards individuals of European ancestry and lacked a replication cohort.
It relied on self-reported cases and symptom status.
No distinction between the loss of taste or smell could be determined as they were combined in a single survey question, making it unclear whether their findings relate more strongly to one symptom or the other.
Currently, there is no clinical imperative to test people in advance to see if they have a genetic predisposition to loss of smell or taste after a COVID-19 infection.
Nevertheless, this new insight into the human genome demonstrates the ongoing pace at which researchers are teasing out useful knowledge about the functions of human DNA. That knowledge will be used to do two things: first, to develop relevant, clinically-useful clinical laboratory tests, and second, to develop therapies for treating people with these genetic predispositions should they experience negative health conditions due to those genetic sequences.
Citizens claiming racial diversity increased by 276% in the 2020 census, leading experts to wonder if racial diversity is increasing or if people are simply electing to identify as such and how this trend will affect healthcare
The last US census showed an interesting change compared to previous census surveys. More Americans identified themselves as racially diverse than in previous censuses. Scientists in multiple specialty areas—including demographics, sociology, genetics, and more—are asking why.
According to federal Census Bureau data, in the most recent census, people who identify as more than one race rose by 276%! Scientists are only just beginning to hypothesize the reasons for this increase, but three potential factors, NPR reported, have emerged:
More children are being born to parents who identify with racial groups that are different from one another.
People are reconsidering what they want the government to know about their identities, according to Duke University Press.
The increased incidence of DNA testing for cultural heritage may be an additional factor in the different ways people identified themselves during the census, driving its popularity, NPR noted. More people are purchasing at-home DNA tests to learn where their ancestors lived and came from, and their family’s genealogy.
“Exactly how big of an effect these tests had on census results is difficult to pin down,” NPR reported. “But many researchers agree that as the cost of at-home kits fell in recent years, they have helped shape an increasing share of the country’s ever-changing ideas about the social construct that is race.”
How the Census Alters Government Policy
Pew Research noted that, although only about 16% of Americans have taken an ancestry DNA test, the marketing efforts of “companies such as 23andMe and Ancestry.com, which operates the AncestryDNA service, should not be underestimated,” NPR reported. They have a wide reach, and those efforts could be impacting how people think about race and ethnic identity.
For most of human history, social experience and contemporary family history have been the drivers of how people identified themselves. However, low-cost DTC genetic testing may be changing that.
One concern that sociologists and demographers have about this trend is that the US census is an important tool in policy, civil rights protections, and even how researchers measure things like healthcare access disparities.
“You’re going to have a lot more people who are not part of marginalized groups in terms of their social experiences claiming to be part of marginalized groups. When it comes to understanding discrimination or inequality, we’re going have very inaccurate estimates,” says Wendy Roth, PhD, Associate Professor of Sociology, University of Pennsylvania, told NPR.
They developed the “genetic options” theory, “to account for how genetic ancestry tests influence consumers’ ethnic and racial identities.” They wrote, “The rapid growth of genetic ancestry testing has brought concerns that these tests will transform consumers’ racial and ethnic identities, producing “geneticized” identities determined by genetic knowledge.”
However, a more healthcare-related motivation for taking a DTC DNA test is to learn about one’s potential risks for familial chronic health conditions, such as cancer, heart disease, and diabetes, etc.
“Whether that occurs through your primary care doctor, your large integrated health network, or your payor, I think there will be profound changes in society’s tolerance for using genetics for prevention,” he told GenomeWeb.
Regardless, as Dark Daily reported in 2020, sales of genetic tests from Ancestry and 23andMe show the market is cooling. Thus, with less than 20% of the population having taken DNA tests, and with sales slowing, genetics testing may not affect responses on the next US census, which is scheduled for April 1, 2030.
In the meantime, clinical laboratory managers should recognize how and why more consumers are interested in ordering their own medical laboratory tests and incorporate this trend into their lab’s strategic planning.