Hacker News Reader

It seems pretty plausible to me, because finding relatives -- especially unknown ones -- is one of the 3 main use cases of the product (the other 2 being understanding your ethnic background and health/disease markers).

They have ~14M users total, so this is 50% of them opting in. That seems entirely reasonable.

View on HN

But how does the hacker get the DNA data? A feature to find relatives is one thing, exposing all those relative's DNA to the current user is another thing entirely. All the math would be done on the backend, not exposed to the end user, no? Or is the implication here that by getting DNA on the 14k compromised users, the attackers can draw meaningful conclusions on the DNA of those in their network?

> But how does the hacker get the DNA data? A feature to find relatives is one thing, exposing all those relative's DNA to the current user is another thing entirely.

They didn't, unless I'm misunderstanding. They just got some names and a number indicating the degree of genetic similarity or something like that, right?

This is 50% of them opting in AND being considered relatives to the 14k who reused vulnerable passwords. For all we know, there may be 99% opt-in but only half the opt-ins are "relatives".

Reply on news.ycombinator.com