Federal class action lawsuit looms as genetics company searches for what went wrong; a reminder to clinical laboratories of the importance of protecting patient information
Several years ago, security experts warned that biotechnology and genomics company 23andMe, along with other similar genetics companies, would be attacked by hackers. Now those predictions appear to have come true, and it should be a cautionary tale for clinical laboratories. In an October 6 blog post, the genetic testing company confirmed that private information from thousands of its customers was exposed and may be being sold on the dark web.
According to Wired, “At least a million data points from 23andMe accounts appear to have been exposed on BreachForums.” BreachForums is an online forum where users can discuss internet hacking, cyberattacks, and database leaks, among other topics.
“Hackers posted an initial data sample on the platform BreachForums earlier this week, claiming that it contained one million data points exclusively about Ashkenazi Jews,” Wired reported, adding that “hundreds of thousands of users of Chinese descent” also appear to be impacted.
The leaked information included full names, dates of birth, sex, locations, photos, and both genetic and ancestry results, Bleeping Computer reported.
For its part, 23andMe acknowledges the data theft but claims “it does not see evidence that its systems have been breached,” according to Wired.
Anne Wojcicki (above) is the co-founder and CEO of genetics company 23andMe, which on October 24 told its customers in an email, “There was unauthorized access to one or more 23andMe accounts that were connected to you through DNA Relatives. As a result, the DNA Relatives profile information you provided in this feature was exposed to the threat actor.” Clinical laboratories must work to ensure their patient data is fully secured from similar cyber theft. (Photo copyright: TechCrunch.)
23andMe Claims Data Leak Not a Security Incident
The data leaked has been confirmed by 23andMe to be legitimate. “Threat actors used exposed credentials from other breaches [of other company’s security] to access 23andMe accounts and steal the sensitive data. Certain 23andMe customer profile information was compiled through access to individual 23andMe.com accounts,” a 23andMe spokesperson told Bleeping Computer.
However, according to the company, the leak does not appear to be a data security incident within the 23andMe systems. “The preliminary results of this investigation suggest that the login credentials used in these access attempts may have been gathered by a threat actor from data leaked during incidents involving other online platforms where users have recycled login credentials,” the spokesperson added.
What the genetics company has determined is that compromised accounts were from users choosing the DNA Relative feature on their website as a means to find and connect to individuals related to them. Additionally, “the number of accounts sold by the cybercriminal does not reflect the number of 23andMe accounts breached using exposed credentials,” Bleeping Computer noted.
Price of Private Information
Following the 23andMe data leak, the private genetic information was quickly available online … for a price.
“On October 4, the threat actor offered to sell data profiles in bulk for $1-$10 per 23andMe account, depending on how many were purchased,” Bleeping Computer reported.
Stolen medical records are becoming hotter than credit card information, the experts say. “Stolen records sell for as much as $1,000 each,” according to credit rating agency Experian, Bleeping Computer noted.
In its 2018 Global Security Report, “cybersecurity firm Trustwave pegged the black-market value of medical records at $250 each. Credit card numbers, on the other hand, sell for around $5 each on the dark web … while Social Security numbers can be purchased for as little as $1 each,” Fierce Healthcare reported.
Clinical laboratory managers and pathologists should take note of the value that the dark web places on the medical records of a patient, compared to the credit card numbers of the same individual. From this perspective, hacking a medical laboratory to steal patient health data can be much more lucrative than hacking the credit card data from a retailer.
“Victims of the breach are now at increased risk of fraud and identity theft, and have suffered damages in the form of invasion of privacy, lost time and out-of-pocket expenses incurred responding to the breach, diminished value of their personal information, and lost benefit of the bargain with 23andMe,” according to court documents.
“The lawsuit brings claims of negligence, breach of implied contract, invasion of privacy/intrusion upon seclusion, unjust enrichment, and declaratory judgment,” Bloomberg Law noted. Additionally, the claim states that 23andMe “failed to provide prompt and adequate notice of the incident.”
Plaintiffs are “seeking actual damages, compensatory damages, statutory damages, punitive damages, lifetime credit-monitoring services, restitution, disgorgement, injunctive relief, attorneys’ fees and costs, and pre-and post-judgment interest,” Bloomberg Law reported.
Preventing Future Data Leaks
Years of experts warning genetics companies like 23andMe that they need more strict data security have proven to be true. “This incident really highlights the risks associated with DNA databases,” Brett Callow, a threat analyst at data security firm Emsisoft, told Wired. “The fact that accounts had reportedly opted into the ‘DNA Relatives’ feature is particularly concerning as it could potentially result in extremely sensitive information becoming public.”
“Callow notes that the situation raises broader questions about keeping sensitive genetic information safe and the risks of making it available in services that are designed like social networks to facilitate sharing. With such platforms come all of the data privacy and security issues that have plagued traditional social networks, including issues related to data centralization and scraping,” Wired noted.
Clinical laboratory databases are full of protected health information (PHI). Wise lab managers will work to ensure that their medical lab’s patient data is secure from today’s cyberthreats.
23andMe executives say they plan to leverage their database of millions of customer genotypes ‘tohelp accelerate personalized healthcare at scale,’ a key goal of precision medicine
In what some financial analysts believe may be an indication that popularity of direct-to-consumer (DTC) genetic testing among customers who seek info on their ethnic background and genetic predisposition to disease is waning, personal genomics/biotechnology company 23andMe announced it has completed its merger with Richard Branson’s VG Acquisition Corp. (NYSE:VGAC) and is now publicly traded on NASDAQ.
According to a 23andMe news release, “The combined company is called 23andMe Holding Co. and will be traded on The Nasdaq Global Select Market (“NASDAQ”) beginning on June 17, 2021, under the new ticker symbol ‘ME’ for its Class A Common shares and ‘MEUSW’ for its public warrants.”
Now that it will file quarterly earnings reports, pathologists and clinical laboratory managers will have the opportunity to learn more about how 23andMe serves the consumer market for genetic types and how it is generating revenue from its huge database containing the genetic sequences from millions of people.
After raising $600 million and being valued at $3.5 billion, CNBC reported that 23andMe’s shares rose by 21% during its first day of trading.
“23andMe is more than just a genetics company. We are an activist brand that is approaching healthcare and drug discovery with the individual at the center, as our partner,” said Anne Wojcicki (above), 23andMe’s co-founder and Chief Executive Officer, during remarks she gave after ringing the opening bell on the company’s first day of public trading, a 23andMe blog post noted. “We are going to continue pioneering a consumer-centered personalized healthcare world. We are going to show that drug discovery can be more efficient when you start with a human genetic insight,” she continued. (Photo copyright: TechCrunch.)
Might the quick rise in its stock price be a sign that 23andMe—with its database of millions of human genotypes—has found a lucrative path forward in drug discovery?
23andMe says that 80% of its 10.7 million genotyped customers have consented to sharing their data for research, MedCity News reported, adding that, “The long-term focus for 23andMe still remains using all of its accumulated DNA data to strike partnerships with pharmaceutical companies.”
Time for a New Direction at 23andMe
While 23andMe’s merger is a recent development, it is not a surprising direction for the Sunnyvale, Calif.-based company, which launched in 2006, to go.
Even prior to the COVID-19 pandemic, both 23andMe and its direct competitor Ancestry had experienced a decline in direct-to-consumer testing sales of at-home DNA and genealogy test kit orders. This decline only accelerated during the pandemic.
Meanwhile, 23andMe Therapeutics, a division focused on research and drug development, has been on the rise, Bloomberg News reported. On its website, 23andMe said it has ongoing studies in oncology, respiratory, and cardiovascular diseases.
“It’s kind of an ideal time for us,” Wojcicki told Bloomberg News.
“There are huge growth opportunities ahead,” said Richard Branson, founder of the Virgin Group, which sponsors the special-purpose acquisition company (SPAC) VG Acquisition Corp., in the 23andMe news release.
In a VG Acquisition Corp. news release, Branson said, “Of the hundreds of companies we reviewed for our SPAC, 23andMe stands head and shoulders above the rest.”
“As an early investor, I have seen 23andMe develop into a company with enormous growth potential. Driven by Anne’s vision to empower consumers, and with our support, I’m excited to see 23andMe make a positive difference to many more people’s lives,” he added.
Report Bullish on Consumer Genetic Testing
Despite the apparent saturation of the direct-to-consumer (DTC) genetic testing market, and consumers’ concerns about privacy, Infiniti Research reported that worldwide sales of DTC tests “are poised to grow by $1.39 bn during 2021-2025, progressing at a CAGR [compound annual growth rate] of over 16% during the forecast period.”
“This study identifies the advances in next-generation genetic sequencing as one of the prime reasons driving the direct-to-consumer genetic testing market growth during the next few years. Also, reduction in the cost of services and growing adoption of online service platforms will lead to sizable demand in the market,” the report states.
Clinical laboratory leaders will want to stay abreast of 23andMe rise as a publicly-traded company. It will be interesting to see if Wojcicki’s vision about moving therapies into clinics in five years comes to fruition.
The merger is expected to boost investment in 23andMe’s consumer health and therapeutics businesses
After years of spectacular growth, the popularity of direct-to-consumer (DTC) genetic testing is beginning to wane. Nevertheless, opportunities still exist in the DTC genetic testing market for visionaries with funds to invest.
One such visionary is billionaire Richard Branson, founder of the multinational venture capital conglomerate Virgin Group (VG). Branson’s VG Acquisition Corp. (NYSE:VGAC), a special purpose acquisition company (SPAC), announced it is merging with 23andMe of Sunnyvale, Calif., to create a publicly-traded company with the New York Stock Exchange ticker symbol ME.
In a VG press release, Branson states his reason for the merger. “Of the hundreds of companies we reviewed for our SPAC, 23andMe stands head and shoulders above the rest,” he said. “As an early investor, I have seen 23andMe develop into a company with enormous growth potential. Driven by [CEO Anne Wojcicki’s] vision to empower consumers, and with our support, I’m excited to see 23andMe make a positive difference to many more people’s lives.”
According to a 23andMe press release, the deal values the company at approximately $3.5 billion and will net the consumer genetics and research company as much as $759 million in additional cash. Wojcicki and Branson each invested $25 million themselves as part of the $250 million fund to take the company public.
“As a fellow industry disruptor as well as an early investor in 23andMe, we are thrilled to partner with Sir Richard Branson and VG Acquisition Corp. as we approach the next phase of our business, which will create new opportunities to revolutionize personalized healthcare and medicine,” 23andMe co-founder and CEO Anne Wojcicki (above) said in the press release. “We have always believed that healthcare needs to be driven by the consumer, and we have a huge opportunity to help personalize the entire experience at scale, allowing individuals to be more proactive about their health and wellness. Through a genetics-based approach, we fundamentally believe we can transform the continuum of healthcare.” (Photo copyright: Inc. magazine.)
Participation in Research Key to Future of DTC Genetics Testing
Though DTC genetic testing kit sales have slowed in recent years for both 23andMe and rival Ancestry, Wojcicki believes the company’s database of 10 million customers—with 80% of customers agreeing to participate in research—is the key to its future.
“We have always seen health as a much bigger opportunity” than genealogy, Wojcicki told The Wall Street Journal (WSJ).
According to the WSJ, 23andMe customers fill out more than 30,000 surveys each day on health and related issues. With that information, the company has determined its database includes 1.7 million people with high cholesterol, nearly 1.6 million with depression and 539,000 with Type 2 diabetes, information that is highly valued by medical researchers and those running clinical trials.
Personalizing Healthcare through DTC Genetic Testing
Wojcicki expects the merger will propel the consumer DNA-testing company into personalized medicine and therapeutics. “We have always believed that healthcare needs to be driven by the consumer, and we have a huge opportunity to help personalize the entire experience at scale, allowing individuals to be more proactive about their health and wellness,” Wojcicki said in a statement. “Through a genetics-based approach, we fundamentally believe we can transform the continuum of healthcare.”
In August 2020, the US Food and Drug Administration “granted 23andMe a 510(k) clearance for a pharmacogenetics report on two medications—Clopidogrel, prescribed for certain heart conditions, and Citalopram, which is prescribed for depression,” 23andMe announced in a blog post.
“This impactful pharmacogenetics information can now be delivered without the need for confirmatory testing, a testament to the clinical validity of 23andMe results,” said Kathy Hibbs, 23andMe Chief Legal and Regulatory Officer, in the blog post. “23andMe remains the only company with direct-to-consumer pharmacogenetic reports cleared by the FDA.”
23andMe’s trove of genetic data already has netted it a partnership with GlaxoSmithKline (GSK). According to a GSK press release, in 2018, the two companies signed a four-year research and development agreement. The collaboration targets novel medicines and potential cures using human genetics as the basis for discovery.
COVID-19 Boosts 23andMe’s Sales
During a joint interview with Branson in Bloomberg News about the merger, Wojcicki said, “COVID-19 has really opened up doors.” Now more than ever, she said, people are interested in preventative healthcare. “I’ve had this dream since 2003 that genetics would revolutionize healthcare and that’s really the era I see we can now usher in,” she added.
As 23andMe pushes further into personalized therapeutics, clinical laboratories and pathology groups would be wise to watch and see if this new entrant accelerates healthcare’s shift to the precision medicine model of personalized care.
At-home genetic test kits face scrutiny for providing information that may provide consumers with an incomplete picture of their genetic health risks and ancestry
Genetic testing for disease risk and heritage are hugely popular. But though clinical laboratory and pathology professionals understand the difference between a doctor-ordered genetic health risk (GHR) test and a direct-to-consumer (DTC) genetic test, the typical genetic test customer may not. And misunderstanding the results of a DTC at-home genetic test can lead to confusion, loss of privacy, and potential harm, according to Consumer Reports.
To help educate consumers about the “potential pitfalls” of at-home DTC testing kits offered by companies such as Ancestry and 23andMe, Consumer Reports has published an article, titled, “Read This Before You Buy a Genetic Testing Kit.” The article covers “four common claims from the manufacturers of these products, whether they deliver, and what to know about their potential pitfalls.”
Are Genetic Ancestry Tests Accurate?
Ancestry and 23andMe are the DTC genetic test industry leaders, with databases of genetic information about 18 million individuals and 10 million individuals respectively. According to a Consumer Reports survey, as of October 2020 about one in five Americans had taken a DTC genetic test. Reported reasons for doing so included:
66% of respondents wanted to learn more about their ancestry.
20% wanted to locate relatives.
18% wanted to learn more about their health.
11% wanted to learn if they have or are a carrier for any medical conditions.
3% wanted to get a medical test they could not get through their doctor.
Though DTC genetic tests remain popular, Consumer Reports is now warning consumers to view the genealogical or medical insights gleaned through these tests with caution. “If you go in there thinking that this test is going to tell you who you are, you’re going to be wrong,” Wendy Roth, PhD (above), Associate Professor of Sociology at the University of Pennsylvania, told the publication. (Photo copyright: University of Pennsylvania.)
As Consumer Reports notes, doctor-ordered genetic health risk (GHR) testing typically aims to answer a specific question about a patient’s risk for a certain disease. DTC at-home genetic testing, on the other hand, examines a “whole range of variants that have been linked—sometimes quite loosely—to a number of traits, some not related to your health at all.
“Think of it this way: When your doctor orders genetic testing, it’s akin to fishing for a particular fish, in a part of the ocean where it’s known to live,” Consumer Reports noted, “A DTC test is more like throwing a net into the ocean and seeing what comes back.”
In its article, Consumer Reports addressed four common DTC genetic test claims:
The Tests Can Find Far-Flung Relatives: While the tests can unearth people in its database whom you might be related to, 9% of respondents in the Consumer Reports survey discovered unsettling information about a relative.
Testing Can Uncover Where Your Ancestors Are From: Genetic tests may show the percentage of your DNA that comes from Europe or Asia or Africa, but accuracy depends on how many DNA samples a company has from a particular region. As genetic test manufacturers’ reference databases widen, a customer’s genetic ancestry test results can “change over time.” Also, finding a particular variation in genetic code does not definitively place someone in a specific region, or ethnic or racial group.
Genetic Tests Can Reveal Your Risk for Certain Diseases: Testing companies such as 23andMe are authorized by the Food and Drug Administration (FDA) to offer physician-mediated tests, which are analyzed in a federally-certified clinical laboratory. However, test results may provide a false sense of security because DTC tests look for only select variants known to cause disease.
The Tests Can Tell What Diet Is Best for You: Incorporating genetic information into diet advice has the potential to be transformative, but the science is not yet there to offer personalized nutritional advice.
Consumer Reports pointed to a 2020 study published in the MDPI journal Nutrients, titled, “Direct-to-Consumer Nutrigenetics Testing: An Overview,” which evaluated 45 DTC companies offering nutrigenetics testing and found a need for “specific guidelines” and “minimum quality standards” for the services offered. For example, the study authors noted that more than 900 genetic variants contribute to obesity risk. However, weight-loss advice from DTC test companies was based on a “limited set of genetic markers.”
In the Consumer Reports article, Mwenza Blell, PhD, a biosocial medical anthropologist and Rutherford Fellow and NUAcT Fellow at Newcastle University in the United Kingdom, said “genetic ancestry tests are closer to palm reading than science.”
Seattle Cancer Care Alliance and an Associate Professor of Oncology at the University of Washington, fears consumers “miss important limitations on a test’s scope” or “misunderstand critical nuances in the results.”
Cheng says the ability to use flexible or health savings accounts (HSAs) to cover the cost of 23andMe’s GHR assessments, as well as the FDA’s approval of 23andMe’s Personal Genome Service Pharmacogenetic Reports test on medication metabolism, may have added to the confusion.
“This may further mislead people into thinking these tests are clinically sound. Again, they are not,” Cheng wrote.
As an oncologist, Cheng is particularly concerned about consumer GHR testing for heritable cancer risk, which screen for only a handful of genetic variants.
“The results are inadequate for most people at high risk of cancers associated with inherited mutations in BRCA1 or BRCA2 genes, including families whose members have experienced ovarian cancer, male breast cancer, multiple early breast cancers, pancreatic cancer, or prostate cancer,” Cheng wrote. “Put simply, this recreational test has zero value for the majority of people who may need it for true medical purposes.”
DTC genetic health-risk assessments may one day lead to consumers collecting samples at home for tests that aid in the diagnosis of disease. In the meantime, clinical laboratory professionals can play a role in educating the public about the limitations of current DTC genetic test offerings.
Though gene sequencing is touted as a key component of precision medicine, the medical value of direct-to-consumer testing has yet to show up in improved health outcomes, nor have clinical laboratories benefitted
In a recent example that the market for genetic genealogy testing may have peaked and the days of spectacular growth in the number of direct-to-consumer (DTC) genetic test orders and revenue is over, private-equity firm Blackstone—in a $4.7 billion deal—announced it will acquire a majority stake in Ancestry, which also does some clinical laboratory genetic testing as well.
Blackstone (NYSE:BX) acquired Ancestry of Lehi, Utah, one of the two largest genealogy testing companies (the other being 23andMe of Sunnyvale, Calif.), from a group of equity holders led by investment firms Silver Lake, GIC, Spectrum Equity, and Permira, noted a press release. GIC will retain a “significant minority stake” in Ancestry.
“We are very excited to partner with Ancestry and its management team. We believe Ancestry has significant runway for further growth as people of all ages and backgrounds become increasingly interested in learning more about their family histories and themselves,” David Kestnbaum, a Senior Managing Director at Blackstone, said in the press release. “We look forward to investing behind further data, functionality, and product development across Ancestry’s market leading platform to continue to provide a differentiated service.”
Is Genetic Testing for Genealogy Still a Growth Industry?
Ancestry is the global leader in digital family history services, operating in more than 30 countries with more than three million paying subscribers across its Ancestry online properties and more than $1 billion in annual revenue.
However, some experts say the road ahead may not be smooth for Ancestry or its major competitor, 23andMe.
“The business landscape fell off a cliff last year,” Laura Hercher, Director of Human Genetics Research at Sarah Lawrence College in New York, told STAT. “Fads pass,” she added.
Hercher points out that Ancestry has “this enormous database, which inherently has a lot of value hidden in it—potential energy. But they have not figured out how to get that information out in the way 23andMe has.”
23andMe’s pivot into medical research gained steam in 2018 when pharmaceutical giant GlaxoSmithKline (NYSE:GSK) purchased a $300 million stake in the company with the aim of using 23andMe’s resources to develop new medicines. That collaboration began bearing fruit earlier this year when GlaxoSmithKline started human trials of the first medicine (a cancer drug) to emerge from the partnership, STAT reported.
The public’s declining interest in at-home genealogy, however, has caused both companies to reduce staffing. 23andMe began the year by laying off about 100 employees—an estimated 14% of its workers—and Ancestry followed suit in February, letting go a similar number of employees, representing roughly 6% of its workforce.
According to MIT Technology Review, direct-to-consumer genetic genealogy testing reached its zenith in 2018 when consumers purchased as many DNA tests in one year as they had in all previous years combined, propelling total sales from Ancestry, 21andMe, and other DTC gene testing companies to roughly $26 million.
In 2019, CNBC reported that, market-wide, roughly 30 million tests had been sold across the globe. However, in recent years, sales have fallen short of expectations as the number of people willing to pay $99 to learn about their ancestry has dwindled. “I suspect those that are curious about this information are thinning out and there’s less people to go around to grow,” Greg Yap (above), Partner at Menlo Ventures, told CNBC. “I think there’s a broader issue, which is that the ultimate medical value is still really unproven,” Yap added. “There’s lots of research being done, but value for mass market consumer isn’t there yet, so it keeps a ceiling on the size of that market.” (Photo copyright: VentureBeat.)
Privacy Still a Concern
Ancestry has begun to insert itself into the genetic testing healthcare arena. In a press release, the company announced the launch of AncestryHealth, a $179 DNA testing kit that uses next generation sequencing (aka, high-throughput or massive parallel sequencing), aimed at providing adult consumers information on their inherited health risks.
However, as MedCity News points out, the sale to Blackstone has increased privacy concerns around the direct-to-consumer DNA testing market. Ancestry’s consumer privacy and data protections remain unchanged under the new ownership, but Alan Butler, Interim Executive Director at Electronic Privacy Information Center (EPIC), told MedCity News, “This is one example of a very troubling trend. It’s something regulatory agencies are not up to date to deal with. It’s one of the reasons we need comprehensive privacy law in the US.”
As genealogy companies such as 23andMe and Ancestry shift their focus from providing genetic histories to improving consumers’ health through genetic testing, clinical laboratories should be mindful of the logical next step, which is predicted to be genetic tests where the consumer collects the sample at home and the test is used to aid in diagnosing and treating patients.
