Who Is Legally Responsible For Your Cybersecurity?

As a cybersecurity professional and expert witness, I like to keep an eye on legal cases that set precedents. Case law allows the public to see the facts of any given case, and more importantly, the judge’s decisions. These decisions create a body of law that can set a precedent for judges in making future decisions on similar issues.

The principle of 'stare decisis', meaning 'to stand by things decided' is central to case law, ensuring legal consistency and predictability. Unfortunately, in the UK, and similarly the US, the vast majority of cases are settled out-of-court and very often bind both parties from disclosing any settlements, concessions or decisions based on the facts.

There is potentially an interesting case law in the offing in the US. 23andMe is a company that provides genetic testing for health and ancestry information. In October 2023, a hacker claimed to have breached 23andMe and sold access on the darkweb for between $1 to $10 per profile. In December 2023, 23andMe admitted that approximately 14,000 people had their accounts directly accessed and that data from a further 1.4 million to 6.9 million customers, depending on reports, had been accessed as a result of preferences that they had set, allowing “potential genetic relatives” to identify them.

As a result of the breach, a number of legal cases have sprung up against 23andMe. As part of their defence, 23andMe have stated that the unauthorized access to user accounts had been a result of a “credential stuffing” attack.

A credential stuffing attack is where attackers use automated scripts to try a large volume of usernames and password combinations against a website or multiple websites. These combinations are often obtained from previous data breaches. The aim is to gain unauthorized access to accounts, exploiting the fact that people often reuse passwords across multiple sites.

As such, 23andMe are essentially saying that it is not their fault that the approximately 14,000 accounts were compromised, because users were re-using passwords that had been breached previously, and that users had failed to update passwords or apply additional, multi-factor verification methods. As for the remaining nearly 7 million individuals, they opted to share their information within the platform.

Credential stuffing could potentially be detected, I’m making no assumptions as to the sophistication of the attacker’s methods or the detection mechanisms within 23andMe’s infrastructure. Such an attack would typically present as tens or hundreds or thousands of unsuccessful login attempts from one or multiple IP addresses. Intermixed with that would be the successful logins for genuine users of the site. This though only accounts for the 14,000 directly compromised accounts. The remaining 6.9 million impacted users opted to share their data on the platform.

There’s going to be many arguments on both sides regarding this case. Ultimately, I suspect that this will come down to a decision regarding duty of care, and who that duty of care lies with. On the one hand, detecting credential stuffing attacks and blocking based on IP addresses, is feasible. On the other hand, threat actors often hide behind VPN’s or infrastructures used to co-host legitimate services. As such, blocking access from these may impact legitimate users and functionality.

Notifying users of logins from new devices or locations is also perfectly feasible. Though users had not opted to enable multi-factor authentication (MFA) as a mechanism to detect mitigate against this type of attack themselves.

One point that does stand out to me is that these accounts had access to 6.9 million people’s data.  This seems like a staggeringly high blast radius, though does also make me question how much of the data would have been accessible to the attacker if, instead of using compromised accounts to gain access, they had signed up legitimately to the platform? And from this, were users provided with sufficient information to provide informed consent? And what boundaries, if any, come with that consent?

While this data loss and its impact has been a result of obvious malicious intent, with the threat actor selling individual records for between $1 and $10 USD on the darkweb; in 2020 the private equity firm “Blackstone” bought the DNA testing company Ancestry for $4.7 billion USD and in 2019 users of Family Tree DNA, a similar platform/service provider, found that their genetic sample, data, and by extension that of their relatives, was being used by the FBI. How are users therefore supposed to analyze, understand, accept, and control the risk of who has access to their data?

The broader point that I would like to see judgement on is where the balance point is between users having to take responsibility for their own password management, data, and cybersecurity and companies securing, monitoring, and responding to detections on their systems.

Ultimately, while I don’t expect these cases to answer all of the questions, or necessarily lay precedent for future actions, there has to come a point where users and providers work together to create a clear understanding of risk, consent, and responsibility.

Mark Cunningham-Dickie is a Senior Incident Responder for Quorum Cyber

Image: Ideogram 

You Might Also Read: 

Cyber Security Governance Is A Leadership Responsibility:

DIRECTORY OF SUPPLIERS - Governance, Risk & Compliance:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« Iranian Hackers Targeted Israel’s Radar Systems
Problems With Underperforming Cyber Security Service Providers  »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

Proofpoint

Proofpoint

Proofpoint provide the most effective cybersecurity and compliance solutions to protect people on every channel including email, the web, the cloud, social media and mobile messaging.

Trulioo

Trulioo

Trulioo is a leading global identity and business verification company providing secure access to data sources worldwide to instantly verify consumers and businesses online.

Cybertron

Cybertron

Cybertron services include real-time monitoring and incident response and a cyber range for competency development.

CyBOK - University of Bristol

CyBOK - University of Bristol

CyBOK is a comprehensive Body of Knowledge to inform and underpin education and professional training for the cyber security sector.

ThreatGen

ThreatGen

ThreatGEN™ works with your team to improve your resiliency and industrial cybersecurity capabilities through an innovative and modernized approach to training and services.

WWPass

WWPass

WWPass is a global cybersecurity company that provides password-less authentication and client-side encryption technology.

Diateam

Diateam

Diateam is an R&D company specializing in computer security. Diateam develops highly innovative cyber range platforms and Industry-leading systems for cybersecurity training and testing labs.

Center for Infrastructure Assurance and Security (CIAS)

Center for Infrastructure Assurance and Security (CIAS)

CIAS is developing the world's foremost center for multidisciplinary education and development of operational capabilities in the areas of infrastructure assurance and security.

Real Protect

Real Protect

Real Protect is a Brazilian provider of managed security (MSS) and cyber defense services.

Digital Security Authority (DSA)

Digital Security Authority (DSA)

The establishment of the Digital Security Authority, which incorporates the National CSIRT, is crucial to significantly raising the cybersecurity posture and capabilities of Cyprus.

Assetnote

Assetnote

The Assetnote platform enables organizations to effectively map and continuously monitor their external attack surface.

Vault Cloud

Vault Cloud

Vault Cloud, Australia's National Cloud, is an Australian owned and operated company specialising in secure, sovereign, hyperscale cloud infrastructure.

Precision Cybertechnologies & Digital Solutions (Precision-Cyber)

Precision Cybertechnologies & Digital Solutions (Precision-Cyber)

Precision-Cyber was founded on the philosophy of state-of-the-art cybersecurity and digital solutions. Our guiding principle is simply that we will provide and secure all your digital needs.

Quotient

Quotient

Quotient builds digital experiences that empower and inspire the American people by understanding their needs, simplifying complex technical solutions and adapting to how they work, live and learn.

SteelGate

SteelGate

SteelGate’s core capabilities are centered around architecture design and engineering of network, systems, and cybersecurity solutions.