Fredericton cybersecurity expert urges 23andMe users to delete data now

Customers of a troubled online service that helps people learn about their ancestry and offers insights into their health could now be vulnerable, a Fredericton cybersecurity expert says.

The genetic testing company 23andMe, famous for its saliva-based DNA testing kits, has filed for bankruptcy and is looking to sell "substantially all" of its assets.

But anyone who may have used the service should take action now, says David Shipley, CEO of Beauceron Security.

Shipley, who said he has used the website himself, urges all users to log into their accounts and delete their data because of the unknowns around a potential sale.

"This is the most intimate and personal information available, right?" Shipley said in an interview with CBC's Shift.

"Not only is it a personal identifier in the most ultimate sense, but it also can be a predictor of current or future health. And this information could be used in ways that individuals may not want or consent to being used."

"You can change a password, you can't change your DNA."

Shipley said he's concerned the federal government has failed to pass a digital charter, which would have included "fundamental rights which we currently don't have" in terms of privacy with this sort of data.   

The worst-case scenario with 23andMe, Shipley said, would be if a major health insurer bought the data. 

"And you know, it kind of leads them to believe that you shouldn't get health insurance in the future," Shipley said. "Or even worse, that your children might be predisposed to certain conditions and thus either should have to pay more or be denied coverage because of that."

"Other examples include selling your DNA information to databases that law enforcement and others work with."

Although the 23andME has agreed not to sell personal data, Shipley said the company's filing for bankruptcy protection and then being sold would undo that.

"It's a clever little legal way of getting around some of those 'We won't ever sell your data clauses.'"

Despite the fact that 23andme had a data breach in 2023, Shipley said, this threat of a sale has led to a moment where he's "never seen as big of a rush to get your data off of those services as quickly as possible."

But the risk of personal data being sold should not undermine the usefulness that 23andme had for some people, he said. 

"It's not to say this idea of knowing more about yourself is inherently always bad or not worth the risk. It's the question of how do we make it better and safer for people to benefit from these technologies?"