Who Is Legally Responsible For Your Cybersecurity?

As a cybersecurity professional and expert witness, I like to keep an eye on legal cases that set precedents. Case law allows the public to see the facts of any given case, and more importantly, the judge’s decisions. These decisions create a body of law that can set a precedent for judges in making future decisions on similar issues.

The principle of 'stare decisis', meaning 'to stand by things decided' is central to case law, ensuring legal consistency and predictability. Unfortunately, in the UK, and similarly the US, the vast majority of cases are settled out-of-court and very often bind both parties from disclosing any settlements, concessions or decisions based on the facts.

There is potentially an interesting case law in the offing in the US. 23andMe is a company that provides genetic testing for health and ancestry information. In October 2023, a hacker claimed to have breached 23andMe and sold access on the darkweb for between $1 to $10 per profile. In December 2023, 23andMe admitted that approximately 14,000 people had their accounts directly accessed and that data from a further 1.4 million to 6.9 million customers, depending on reports, had been accessed as a result of preferences that they had set, allowing “potential genetic relatives” to identify them.

As a result of the breach, a number of legal cases have sprung up against 23andMe. As part of their defence, 23andMe have stated that the unauthorized access to user accounts had been a result of a “credential stuffing” attack.

A credential stuffing attack is where attackers use automated scripts to try a large volume of usernames and password combinations against a website or multiple websites. These combinations are often obtained from previous data breaches. The aim is to gain unauthorized access to accounts, exploiting the fact that people often reuse passwords across multiple sites.

As such, 23andMe are essentially saying that it is not their fault that the approximately 14,000 accounts were compromised, because users were re-using passwords that had been breached previously, and that users had failed to update passwords or apply additional, multi-factor verification methods. As for the remaining nearly 7 million individuals, they opted to share their information within the platform.

Credential stuffing could potentially be detected, I’m making no assumptions as to the sophistication of the attacker’s methods or the detection mechanisms within 23andMe’s infrastructure. Such an attack would typically present as tens or hundreds or thousands of unsuccessful login attempts from one or multiple IP addresses. Intermixed with that would be the successful logins for genuine users of the site. This though only accounts for the 14,000 directly compromised accounts. The remaining 6.9 million impacted users opted to share their data on the platform.

There’s going to be many arguments on both sides regarding this case. Ultimately, I suspect that this will come down to a decision regarding duty of care, and who that duty of care lies with. On the one hand, detecting credential stuffing attacks and blocking based on IP addresses, is feasible. On the other hand, threat actors often hide behind VPN’s or infrastructures used to co-host legitimate services. As such, blocking access from these may impact legitimate users and functionality.

Notifying users of logins from new devices or locations is also perfectly feasible. Though users had not opted to enable multi-factor authentication (MFA) as a mechanism to detect mitigate against this type of attack themselves.

One point that does stand out to me is that these accounts had access to 6.9 million people’s data.  This seems like a staggeringly high blast radius, though does also make me question how much of the data would have been accessible to the attacker if, instead of using compromised accounts to gain access, they had signed up legitimately to the platform? And from this, were users provided with sufficient information to provide informed consent? And what boundaries, if any, come with that consent?

While this data loss and its impact has been a result of obvious malicious intent, with the threat actor selling individual records for between $1 and $10 USD on the darkweb; in 2020 the private equity firm “Blackstone” bought the DNA testing company Ancestry for $4.7 billion USD and in 2019 users of Family Tree DNA, a similar platform/service provider, found that their genetic sample, data, and by extension that of their relatives, was being used by the FBI. How are users therefore supposed to analyze, understand, accept, and control the risk of who has access to their data?

The broader point that I would like to see judgement on is where the balance point is between users having to take responsibility for their own password management, data, and cybersecurity and companies securing, monitoring, and responding to detections on their systems.

Ultimately, while I don’t expect these cases to answer all of the questions, or necessarily lay precedent for future actions, there has to come a point where users and providers work together to create a clear understanding of risk, consent, and responsibility.

Mark Cunningham-Dickie is a Senior Incident Responder for Quorum Cyber

Image: Ideogram 

You Might Also Read: 

Cyber Security Governance Is A Leadership Responsibility:

DIRECTORY OF SUPPLIERS - Governance, Risk & Compliance:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« Iranian Hackers Targeted Israel’s Radar Systems
Problems With Underperforming Cyber Security Service Providers  »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

TÜV SÜD Academy UK

TÜV SÜD Academy UK

TÜV SÜD offers expert-led cybersecurity training to help organisations safeguard their operations and data.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Voyager Networks

Voyager Networks

Voyager Networks is an IT solutions business with a focus on Enterprise Networks, Security and Collaborative Communications.

High-Tech Bridge

High-Tech Bridge

High-Tech Bridge SA is a Swiss MSSP provider offering security auditing, source code review and computer forensics.

CERT-FR

CERT-FR

CERT-FR is the French national government computer security incident response team.

Homeland Security Advanced Research Projects Agency (HSARPA)

Homeland Security Advanced Research Projects Agency (HSARPA)

HSARPA's Cyber Security Division (CSD) was set up to address DHS cyber operational and critical infrastructure protection requirements.

Veridify Security

Veridify Security

Veridify Security (formerly SecureRF), develops and licenses quantum-resistant, public-key security tools for the low-resource processors powering the Internet of Things.

ObserveIT

ObserveIT

ObserveIT helps companies identify & eliminate insider threats. Visually monitor & quickly investigate with our easy-deploy user activity monitoring solution.

Vade Secure

Vade Secure

Vade Secure provides protection against the most sophisticated email scams such as phishing and spear phishing, malware and ransomware.

Cyber Security Capital (CS^)

Cyber Security Capital (CS^)

Cyber Security Capital is a consultancy helping to mobilise and empower individuals, corporate leaders and entrepreneurs in cyber security.

Secret Double Octopus

Secret Double Octopus

Secret Double Octopus offers the world’s only keyless multi-shield authentication technology for users and things.

Department of Justice - Office of Cybercrime (DOJ-OOC)

Department of Justice - Office of Cybercrime (DOJ-OOC)

The Office of Cybercrime within the Philippines Department of Justice is the Central Authority in all matters relating to international mutual assistance and extradition for cybercrime.

KDM Analytics

KDM Analytics

KDM Analytics software products automate the NIST risk management framework (RMF) assessment for operational technology (OT) systems.

Skudo

Skudo

Skudo is dedicated to creating innovative best-in-class solutions that protect data exchange with the highest level of security and privacy.

Elisity

Elisity

Elisity Cognitive Trust is a new security paradigm that combines Zero Trust Network Access and an AI-enabled Software Defined Perimeter.

Omega Systems

Omega Systems

Omega Systems is a leading managed service provider (MSP) and managed security service provider (MSSP) to mid-market organizations.

Project Cypher

Project Cypher

Project Cypher leverages the latest cybersecurity developments, a world class team of hackers and constant R&D to provide you with unparalleled cybersecurity offerings.

Interpres Security

Interpres Security

Interpres Security operationalizes TTP-based threat intelligence and automates continuous exposure monitoring to help CISOs and security practitioners reduce threat exposure.