Hackers were able to gain access to the personal information of 6.9 million 23andMe customers in a data breach, the company confirmed on Tuesday — representing nearly half of 23andMe’s reported user base of 14 million customers.
The genetic testing company, which offers health insights and ancestry information based on customer-submitted DNA collected by saliva swabs, said it learned of the hack in early October. After weeks of speculation, the true extent of the data breach has been revealed.
In some cases, users’ names, family trees, ancestry reports, locations, profile pictures and birth years were leaked. While the stolen data does not include DNA records, 23andMe told Global News in an email that the breach may have leaked “specifically where on (users’) chromosomes they and their relative had matching DNA.”
According to a proposed class-action lawsuit against 23andMe filed in B.C. Supreme Court, this stolen information was then put up for sale on the dark web.
The lead plaintiff in the lawsuit is an unnamed B.C. man, whose identity is protected under a publication ban, lawyer Sage Nematollahi told Global News.
Nematollahi’s firm KND Complex Litigation and Vancouver-based law firm YLaw Group are working together to pursue this class-action lawsuit.
Nematollahi said in a phone interview that “thousands” of Canadians have reached out to his law firm in the wake of the data breach, seeking to join the class-action suit. He said the volume of inquiries was “unprecedented” in his career.
More on World
The lawsuit alleges that 23andMe engaged in “willful, knowing or reckless conduct” by not implementing and maintaining proper data retention and data protection practices.
“As a result, they affirmatively exposed the highly sensitive and highly valuable customer data in their control, custody or possession to unauthorized parties and cybercriminals,” the lawsuit reads.
The suit seeks unspecified monetary damages, including the price that affected customers paid for 23andMe’s services as well as further damages resulting from the data breach. The proposed class-action lawsuit is open to anyone residing in Canada whose personal information was leaked by 23andMe.
Nematollahi wrote in a statement that, as a large business operator, 23andMe is held to “stringent standards under Canadian privacy laws, which require it to properly and responsibly manage and protect its customers’ highly sensitive and highly valuable personal information.”
“It is our hope that this class action will shed light on the facts, provide access to justice to Canadian customers who have been affected by this situation, and promote behaviour modification and responsible data management practices in the industry,” he added.
The proposed class-action lawsuit is being “actively pursued,” Nematollahi said, and the next court date for the case is slated for January.
Nematollahi says he and his colleagues are seeking an expedited court date to discuss recent tactics undertaken by 23andMe, which include a change to their terms of service that would force users into binding arbitration for any legal disputes. This means users would not be able to file or join class-action lawsuits.
23andMe is only giving users 30 days from when they receive the email about the new policy to opt out, The Verge reports. Users can opt out by contacting arbitrationoptout@23andme.com.
“We have strong objections to these moves and tactics, and are taking steps to address this situation with the Court on an urgent basis in order to protect the interests of our clients and Canadian customers of 23andMe,” Nematollahi said.
How did the leak happen?
The company says a “threat actor” gained access to a small percentage of 23andMe accounts via “credential stuffing.”
“That is, usernames and passwords that were used on 23andMe.com were the same as those used on other websites that have been previously compromised or otherwise available,” 23andMe said in a blog post.
The hackers were able to access 14,000 accounts, less than 0.1 per cent of the user base, using these usernames and passwords that had previously been leaked. From this small seed, the hackers were able to access information from millions more accounts through 23andMe’s DNA Relatives and Family Tree features, which allow users to share information with other users they are genetically linked to.
Approximately 5.5 million users had data leaked from their DNA Relatives profile, as well as an additional 1.4 million users through the Family Tree feature, “each of which were connected to the compromised accounts,” 23andMe says.
The genetic testing company says it emailed all customers to notify them of the data breach and now requires all new and existing users to log in to their accounts using two-step verification.
“Protecting our customers’ data privacy and security remains a top priority for 23andMe, and we will continue to invest in protecting our systems and data,” the company said.
It recommends that customers change their password to one that is not easy to guess and is unique to their account.
Users can also opt out of the DNA Relatives feature to prevent their information from being shared with other accounts. Customers can opt out by selecting the “Manage Preferences” option on their “Account Settings” page.
Users who want to fully delete their 23andMe accounts and personal information can do so within the “23andMe Data” section on their “Account Settings” page.
“While we will delete the majority of your Personal Information, we are required to retain some information to comply with our legal obligations,” 23andMe writes on its website. “Deleting an account and associated data will permanently delete the data associated with all profiles within the account.”
TORONTO – Canada Goose Holdings Inc. says it has signed a deal that will result in the creation of its first eyewear collection.
The deal announced on Thursday by the Toronto-based luxury apparel company comes in the form of an exclusive, long-term global licensing agreement with Marchon Eyewear Inc.
The terms and value of the agreement were not disclosed, but Marchon produces eyewear for brands including Lacoste, Nike, Calvin Klein, Ferragamo, Longchamp and Zeiss.
Marchon plans to roll out both sunglasses and optical wear under the Canada Goose name next spring, starting in North America.
Canada Goose says the eyewear will be sold through optical retailers, department stores, Canada Goose shops and its website.
Canada Goose CEO Dani Reiss told The Canadian Press in August that he envisioned his company eventually expanding into eyewear and luggage.
This report by The Canadian Press was first published Sept. 19, 2024.
Almost seven years since news broke of an alleged conspiracy to fix the price of packaged bread across Canada, the saga isn’t over: the Competition Bureau continues to investigate the companies that may have been involved, and two class-action lawsuits continue to work their way through the courts.
Here’s a timeline of key events in the bread price-fixing case.
Oct. 31, 2017: The Competition Bureau says it’s investigating allegations of bread price-fixing and that it was granted search warrants in the case. Several grocers confirm they are co-operating in the probe.
Dec. 19, 2017: Loblaw and George Weston say they participated in an “industry-wide price-fixing arrangement” to raise the price of packaged bread. The companies say they have been co-operating in the Competition Bureau’s investigation since March 2015, when they self-reported to the bureau upon discovering anti-competitive behaviour, and are receiving immunity from prosecution. They announce they are offering $25 gift cards to customers amid the ongoing investigation into alleged bread price-fixing.
Jan. 31, 2018: In court documents, the Competition Bureau says at least $1.50 was added to the price of a loaf of bread between about 2001 and 2016.
Dec. 20, 2019: A class-action lawsuit in a Quebec court against multiple grocers and food companies is certified against a number of companies allegedly involved in bread price-fixing, including Loblaw, George Weston, Metro, Sobeys, Walmart Canada, Canada Bread and Giant Tiger (which have all denied involvement, except for Loblaw and George Weston, which later settled with the plaintiffs).
Dec. 31, 2021: A class-action lawsuit in an Ontario court covering all Canadian residents except those in Quebec who bought packaged bread from a company named in the suit is certified against roughly the same group of companies.
June 21, 2023: Bakery giant Canada Bread Co. is fined $50 million after pleading guilty to four counts of price-fixing under the Competition Act as part of the Competition Bureau’s ongoing investigation.
Oct. 25 2023: Canada Bread files a statement of defence in the Ontario class action denying participating in the alleged conspiracy and saying any anti-competitive behaviour it participated in was at the direction and to the benefit of its then-majority owner Maple Leaf Foods, which is not a defendant in the case (neither is its current owner Grupo Bimbo). Maple Leaf calls Canada Bread’s accusations “baseless.”
Dec. 20, 2023: Metro files new documents in the Ontario class action accusing Loblaw and its parent company George Weston of conspiring to implicate it in the alleged scheme, denying involvement. Sobeys has made a similar claim. The two companies deny the allegations.
July 25, 2024: Loblaw and George Weston say they agreed to pay a combined $500 million to settle both the Ontario and Quebec class-action lawsuits. Loblaw’s share of the settlement includes a $96-million credit for the gift cards it gave out years earlier.
Sept. 12, 2024: Canada Bread files new documents in Ontario court as part of the class action, claiming Maple Leaf used it as a “shield” to avoid liability in the alleged scheme. Maple Leaf was a majority shareholder of Canada Bread until 2014, and the company claims it’s liable for any price-fixing activity. Maple Leaf refutes the claims.
This report by The Canadian Press was first published Sept. 19, 2024.
Companies in this story: (TSX:L, TSX:MFI, TSX:MRU, TSX:EMP.A, TSX:WN)
TORONTO – TD Bank Group, which is mired in a money laundering scandal in the U.S., says chief executive Bharat Masrani will retire next year.
Masrani, who will retire officially on April 10, 2025, says the bank’s, “anti-money laundering challenges,” took place on his watch and he takes full responsibility.
The bank named Raymond Chun, TD’s group head, Canadian personal banking, as his successor.
As part of a transition plan, Chun will become chief operating officer on Nov. 1 before taking over the top job when Masrani steps down at the bank’s annual meeting next year.
TD also announced that Riaz Ahmed, group head, wholesale banking and president and CEO of TD Securities, will retire at the end of January 2025.
TD has taken billions in charges related to ongoing U.S. investigations into the failure of its anti-money laundering program.
This report by The Canadian Press was first published Sept. 19, 2024.
