MyHeritage Class Action Lawsuit Says DNA Reports Exposed in Data Hack

A Florida woman alleges in a class action lawsuit that her personal identifying information was exposed to hackers who breached the security of a DNA ancestry company MyHeritage.

Showneen Hall claims in the MyHeritage class action lawsuit that the company, based in Israel, was exposed to a data breach affecting consumers who signed up for the service until Oct. 26, 2017.

According to the plaintiff, MyHeritage encourages users to provide a raft of personal information to add to their family history, including maiden names, and other intimate details of their past “all of which are typically used for password reminders and resets with financial institutions, healthcare providers, and other companies with which consumers entrust [personal identifying information] and [protected health information].”

“Despite storing sensitive Private Information that they knew or should have known was valuable to and vulnerable to cyber attackers, Defendants failed to take adequate measures that could have protected user’s Private Information,” alleges the MyHeritage DNA data hack class action lawsuit.

According to the MyHeritage class action, users were notified in June 2018 that the information security team at MyHeritage had been notified by a security researcher about the discovery of files containing the email addresses and hashed passwords on a private server outside of the company.

The MyHeritage data breach class action lawsuit alleges that all users who signed up before Oct. 26, 2017 were affected by the breach.

The MyHeritage DNA data hack class action lawsuit claims that the company collects “massive amounts of Private Information” as a part of their ancestry service.

Hall says that she and other consumers would not have signed up for the service if they had known MyHeritage did not adequately protect that information.

“Consumers place value in data privacy and security, and they consider it when making decisions regarding their online behavior, especially signing up for an online DNA genealogy analysis site,” alleges the MyHeritage DNA data hack class action lawsuit.

“Plaintiff would not have utilized Defendants’ services had she known that Defendants did not take all necessary precautions to secure the Private Information that consumers provide to Defendants.”

The tech and medical fields are “rife” with examples of hackers targeting the type of information collected by the company, contends the MyHeritage data hack class action lawsuit.

MyHeritage should have been aware that the information they store is especially valuable to hackers. In fact, the company was warned several times, alleges the plaintiff, both by the FBI and expert publications in the field.

“Just months before the represented date of the breach, Gizmodo reported that DNA testing data was ‘disturbingly vulnerable to hackers,’” alleges the MyHeritage DNA data hack class action lawsuit, noting that researchers had concluded in a presentation just three months prior to the hack that the security of open-source DNA processing programs are, “in general, lacking.”

The MyHeritage data breach class action lawsuit contends that the plaintiff and putative Class Members are now vulnerable to fraud and identity theft.

Hall contends that the theft of DNA information is even more valuable to hackers because it allows them to commit fraud that is difficult to unravel.

The plaintiff is represented by Steven A. Chistensen and Cameron Christensen of Christensen Young & Associates PLLC, and by John A. Yanchunis, Jean S. Martin, and Ryan J. McGee of Morgan & Morgan Complex Litigation Group.

The MyHeritage DNA Data Hack Class Action Lawsuit is Hall v. MyHeritage LTD, et al., Case No. 2:18-cv-00721-EJF, in the U.S. District Court for the District of Utah.

UPDATE: The MyHeritage DNA Data Hack Class Action Lawsuit was dismissed on December 6, 2018.