23andMe bankruptcy: With America’s DNA put on sale, market panic gets a new form of testing
Signage at 23andMe headquarters in Sunnyvale, California, U.S., on Wednesday, Jan. 27, 2021.
David Paul Morris | Bloomberg | Getty Images
DNA testing has become a valuable tool for hobbyists and novice genealogists. For some, learning they are the 10th cousin of Paul Revere or the 15th great nephew four times removed of the last King of Prussia is worth the perceived risk of sharing a DNA sample. But what happens when the company harvesting the DNA goes bankrupt?
That was the question posed to millions of Americans last week when 23andMe, the company that popularized consumer genetic testing and had early backing from Google, filed for bankruptcy, leading to a wave of calls for Americans to delete their DNA from the company’s database.
While it’s not 100 percent clear if the “delete your DNA” calls were warranted, privacy experts are alarmed, and Americans who had taken the genetic test took the advice to heart.
According to data from online traffic analysis company Similarweb, on March 24, the day of the bankruptcy announcement, 23andMe received 1.5 million visits to its website, a 526% increase from one day prior. According to Similarweb, 376,000 visits were made to help pages specifically related to deleting data, and 30,000 were made to the customer care page for account closure. The next day, that figure rose to 1.7 million visits, and rraffic to the delete data help page about 480,000.
Margaret Hu, professor of law and director of the Digital Democracy Lab at William & Mary Law School, thinks Americans made the right move. “This development is a disaster for data privacy,” said Hu. In her view, the 23andMe bankruptcy should serve as a warning as to why the federal government needs strong data protection laws.
In some states, Hu noted, the government is taking an active role in counseling consumers. The California Attorney General’s Office is urging Californians to delete their data and have 23andMe destroy saliva samples. But Hu says that is not enough, and such guidance should be provided to all U.S. citizens.
The potential national security implications of 23andMe’s data falling into the wrong hands are not new. In fact, the Pentagon had previously warned military personnel that these DNA kits could pose a risk to national security.
Exposing DNA collected from consumers is not a new issue for 23andMe, either. In 2023, almost 7 million people who took the genetic test were already exposed in a major 23andMe data breach. The company signed an agreement that involved a $30 million settlement and a promise of three years’ worth of security monitoring.
But Hu says the bankruptcy does make the company, and its data, especially vulnerable now.
Drug research and genetic testing data
One of the things notable about the consumer mindset in the early years of the popularization of genetic testing was that a majority of users opted into sharing their DNA for research purposes, as much as 80% in the years when 23andMe was growing rapidly. Then, as the market for consumer sale of the popular DNA test kits reached saturation sooner than many expected, 23andMe focused more on research and development partnerships with drug companies as a way to diversify its revenue.
Currently, when 23andMe sells genetic data to other research companies, most is used at an aggregate level, as part of millions of data points being analyzed as a whole. The company also strips out identifying data from the genetic data, and no registration information (like a name or email) is included. Data researchers do need, such as date of birth, is stored separately from genetic data, and shared with randomly assigned IDs.
Hu is among the experts concerned these practices could change under 23andMe or any new buyer. “In a time of financial vulnerability, companies such as pharmaceutical companies might see an opportunity to exploit the research benefits of the genetic data,” Hu said, adding that they might try to renegotiate prior contracts to extract more data from the company. “Will the next company that buys 23andMe do that?,” Hu said of its privacy policies.
In recent days, 23andMe has said it will try to find a buyer who shares its privacy values.
23andMe did not respond to a request for comment.
Anne Wojcicki, 23andMe Co-Founder & CEO pushes the button, remotely ringing the NASDAQ opening bell at the headquarters of DNA tech company 23andMe in Sunnyvale, California, U.S., June 17, 2021.
Peter DaSilva | Reuters
Over the years since 23andMe’s founding in 2006, many customers were willing to send in a swab to learn more about their family history. Lansing, Michigan resident Elaine Brockhaus, 70, and her family were excited to learn more about their lineage when they submitted samples of their DNA to 23andMe. But with the company now teetering in bankruptcy and privacy experts concerned about what happens to the millions of people with DNA samples stored, Brockhaus says the whole thing has “caused a bit of a ruckus in my family.”
“We enjoyed some aspects of 23&Me,” Brockhaus said. “They continually refined and updated our heritage as more people joined, and they were better able to pinpoint genetically related groups,” Brockhaus said. She was able to learn more about health risk factors that were present or not present in her past.
Now, her family has come full circle in the 23andMe experience: some members were initially reluctant to go along, and now, Brockhaus says, everyone has deleted their accounts.
A unique company collapse, but everyday cyber risks
But Brockhaus continues to view 23andMe within a larger consumer health market where the risks are not new, and health information is being shared in all sorts of environments where security issues could arise. “Anyone sending ColoGuard or receiving medical results through the mail is taking a risk of exposure,” Brockhaus said. “Our very identities can be stolen with a few keystrokes. Of course, this does not mean that we should throw up our hands and agree to be victims, but unless we want to dig holes out back and live in them we have to be vigilant, proactive, but not panicked,” she added.
Jon Clay, vice president of threat intelligence at cybersecurity firm Trend Micro, says consumers of 23andMe do need to view the bankruptcy as a threat. In any sale process, if the data is not transferred and guarded in the most secure manner possible, “it is at risk of being used by malicious actors for a number of nefarious purposes,” he said.
Clay thinks 23andMe’s data is incredibly valuable to cybercriminals — not just because it’s permanent and personally identifiable, but also because it can be exploited for identity theft, blackmail, or even medical fraud.
“Cybercriminals can use it to target consumers with convincing scams and social engineering tactics, such as fraudulently claiming someone is a blood relative to another person or to send deceptive messages about their potential health risks,” Clay said. “Organizations who go bankrupt should ensure the security and privacy of their customer’s data is critical, and any sharing or selling of data to others should not be done,” he added.
But other experts say the lesson of 23andMe is less about the company’s collapse and the threat to privacy that created than serving as a reminder about the everyday cyber hazards related to personal information.
“When people start talking about personal data, they forget where their data is already sitting,” says Rob Lee, chief of research and head of faculty at SANS Institute, which specializes in helping businesses with information security and cyber issues. Whether it’s sending a blood sample into a private lab or getting rid of a laptop to upgrade to a new one, “your digital footprints are being left out there for people to find,” Lee said. “People don’t understand the scope, so there is a larger discussion out there, specifically around where does data go?”
With DNA information, there are certain basic legal factors people should weigh before swabbing themselves and sending the sample in.
According to Lynn Sessions, an expert on healthcare privacy and digital assets and partner at the law firm BakerHostetler, the federal law that covers patient information privacy, HIPAA, does not apply to this situation, and 23andMe would not be considered a HIPAA-covered entity, or business associate of one. But there are state laws that apply to genetic information that would be in play, such as in California.
Meredith Schnur, a managing director and cybersecurity leader at insurance company Marsh, thinks the risk from 23andMe’s bankruptcy for people who sent in their swabs is relatively low. “It doesn’t cause any additional consternation or heartburn,” Schnur said. “I just don’t think it opens up any additional risk that doesn’t already exist,” she said, adding that many people’s information is “already out there.”
Last week, a 23andMe co-founder, Linda Avey, blasted the company’s leadership. “Without continued consumer-focused product development, and without governance, 23andMe lost its way, and society missed a key opportunity in furthering the idea of personalized health,” Avey wrote in a social media post. “There are many cautionary tales buried in the 23andMe story,” Avey said.
The bankruptcy itself is the issue that is now hard for consumers to ignore, and until the sale process is completed, the questions will remain.
“When you’re in bankruptcy, data privacy values are not what you’re really thinking about. You’re thinking about selling your company to the highest bidder,” Hu said. That highest bidder, Hu says might take the genetic data and consumer profile data and link them together when selling it to others.
And that initial sale which includes the DNA of millions of people may only be the first of many transactions.
“It might sell it off, piece by piece, indiscriminately. And the buyer of that data might be a foreign adversary,” Hu said. “That is why this is not just a data privacy disaster. It’s also a national security disaster.”
A banner for Snowflake Inc. is displayed at the New York Stock Exchange to celebrate the company’s initial public offering on Sept. 16, 2020.
Brendan McDermid | Reuters
MongoDB’s stock just closed out its best week on record, leading a rally in enterprise technology companies that are seeing tailwinds from the artificial intelligence boom.
In addition to MongoDB’s 44% rally, Pure Storage soared 33%, its second-sharpest gain ever, while Snowflake jumped 21%. Autodesk rose 8.4%.
Since generative AI started taking off in late 2022 following the launch of OpenAI’s ChatGPT, the big winners have been Nvidia, for its graphics processing units, as well as the cloud vendors like Microsoft, Google and Oracle, and companies packaging and selling GPUs, such as Dell and Super Micro Computer.
For many cloud software vendors and other enterprise tech companies, Wall Street has been waiting to see if AI will be a boon to their business, or if it might displace it.
Quarterly results this week and commentary from company executives may have eased some of those concerns, showing that the financial benefits of AI are making their way downstream.
MongoDB CEO Dev Ittycheria told CNBC’s “Squawk Box” on Wednesday that enterprise rollouts of AI services are happening, but slowly.
“You start to see deployments of agents to automate back office, maybe automate sales and marketing, but it’s still not yet kind of full force in the enterprise,” Ittycheria said. “People want to see some wins before they deploy more investment.”
Revenue at MongoDB, which sells cloud database services, rose 24% from a year earlier to $591 million, sailing past the $556 million average analyst estimate, according to LSEG. Earnings also exceeded expectations, as did the company’s full-year forecast for profit and revenue.
MongoDB said in its earnings report that it’s added more than 5,000 customers year-to-date, “the highest ever in the first half of the year.”
“We think that’s a good sign of future growth because a lot of these companies are AI native companies who are coming to MongoDB to run their business,” Ittycheria said.
Pure Storage enjoyed a record pop on Thursday, when the stock jumped 32% to an all-time high.
The data storage management vendor reported quarterly results that topped estimates and lifted its guidance for the year. But what’s exciting investors the most is early returns from Pure’s recent contract with Meta. Pure will help the social media company manage its massive storage needs efficiently with the demands of AI.
Pure said it started recognizing revenue from its Meta deployments in the second quarter, and finance chief Tarek Robbiati said on the earnings call that the company is seeing “increased interest from other hyperscalers” looking to replace their traditional storage with Pure’s technology.
‘Banger of a report’
Reports from MongoDB and Pure landed the same week that Nvidia announced quarterly earnings, and said revenue soared 56% from a year earlier, marking a ninth-straight quarter of growth in excess of 50%.
Nvidia has emerged as the world’s most-valuable company by selling advanced AI processors to all of the infrastructure providers and model developers.
While growth at Nvidia has slowed from its triple-digit rate in 2023 and 2024, it’s still expanding at a much faster pace than its megacap peers, indicating that there’s no end in sight when it comes to the expansive AI buildouts.
“It was a banger of a report,” said Brad Gerstner CEO of Altimeter Capital, in an interview with CNBC’s “Halftime Report” on Thursday. “This company is accelerating at scale.”
Data analytics vendor Snowflake talked up its Snowflake AI data cloud in its quarterly earnings report on Wednesday.
Snowflake shares popped 20% following better-than-expected earnings and revenue. The company also boosted its guidance for the year for product revenue, and said it has more than 6,100 customers using Snowflake AI, up from 5,200 during the prior quarter.
“Our progress with AI has been remarkable,” Snowflake CEO Sridhar Ramaswamy said on the earnings call. “Today, AI is a core reason why customers are choosing Snowflake, influencing nearly 50% of new logos won in Q2.”
Autodesk, founded in 1982, has been around much longer than MongoDB, Pure Storage or Snowflake. The company is known for its AutoCAD software used in architecture and construction.
The company has underperformed the broader tech sector of late, and last year activist investor Starboard Value jumped into the stock to push for improvements in operations and financial performance, including cost cuts. In February, Autodesk slashed 9% of its workforce, and two months later the company settled with Starboard, adding two newcomers to its board.
The stock is still trailing the Nasdaq for the year, but climbed 9.1% on Friday after Autodesk reported results that exceeded Wall Street estimates and increased its full-year revenue guidance.
Last year, Autodesk introduced Project Bernini to develop new AI models and create what it calls “AI‑driven CAD engines.”
On Thursday’s earnings call, CEO Andrew Anagnost was asked what he’s most excited about across his company’s product portfolio when it comes to AI.
Anagnost touted the ability of Autodesk to help customers simplify workflow across products and promoted the Autodesk Assistant as a way to enhance productivity through simple prompts.
He also addressed the elephant in the room: The existential threat that AI presents.
“AI may eat software,” he said, “but it’s not gonna eat Autodesk.”
WATCH: Autodesk CEO on Q2 earnings
-
Sports3 years ago‘Storybook stuff’: Inside the night Bryce Harper sent the Phillies to the World Series
-
Sports1 year agoStory injured on diving stop, exits Red Sox game
-
Sports2 years agoGame 1 of WS least-watched in recorded history
-
Sports2 years agoMLB Rank 2023: Ranking baseball’s top 100 players
-
Sports4 years ago
Team Europe easily wins 4th straight Laver Cup
-
Sports2 years agoButton battles heat exhaustion in NASCAR debut
-
Environment2 years agoJapan and South Korea have a lot at stake in a free and open South China Sea
-
Environment11 months agoHere are the best electric bikes you can buy at every price level in October 2024