DNA Diagnostics Center

History

2023: $400,000 fine for data breach

At the end of February 2023, litigation between prosecutors from the states of Ohio and Pennsylvania and DNA Diagnostics Center, which provides DNA testing services, ended in the United States. The latter will have to pay a large fine.

According to The Record, in 2021, hackers hacked into the DNA Diagnostics Center database and stole data from $2.1 million people, including social security numbers of 45 thousand customers from Ohio and Pennsylvania. The stolen data was part of an old database that DNA Diagnostics Center collected in 2019, but then apparently forgot that she had it. DDC subsequently said it was not aware of the data in its IT systems, claiming a preliminary inventory of its digital vaults found no sign of information about millions of people that was subsequently stolen.

The company will pay $400 thousand.

After the acquisition, DDC conducted a penetration test but focused only on databases with active customer data, investigators said. By May 28, 2021, DDC received an automatic warning from its managed service provider that suspicious activity was taking place on the Orchid Cellmark network. The same managed service provider repeatedly contacted the DDC to warn them that the network was being accessed, but all this was ignored until August 2021, when attackers installed the Cobalt Strike malware. Following this notification, the DDC began implementing its incident response plan.

Of the 2.1 million people whose data was leaked, 12,663 were from Pennsylvania and 33,282 were from Ohio. The leak included Social Security numbers and medical details. U.S. prosecutors have accused DNA Diagnostics Center of violating several laws, including the Consumer Protection Act, for misrepresenting its efforts to protect consumer data. For its negligence, DNA Diagnostics Center will have to pay state governments a total of $400,000. Since the beginning of March 2023, the company has been obliged to hire special employees who will monitor cybersecurity.^[1]

Notes