Vitagene vitagene.com Vitagene data breach: what happened and what to do
Vitagene, a DNA testing company, left thousands of customer health reports on a publicly accessible cloud database. The company says it was alerted on July 1, 2019. Names, birthdates and gene-based health information were exposed.
View all 13,177 breaches- Breach date
- Jul 2019
- Data exposed
- Names, Dates of birth, Genetic information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Vitagene sold DNA tests that produced health and ancestry reports. In July 2019, news outlets reported that a misconfigured Amazon Web Services storage bucket had left more than 3,000 customer health reports open to anyone on the internet for years. Vitagene said it was notified on July 1, 2019 and fixed the problem. It said a small fraction of customers from 2015 to 2017 may have been affected.
The U.S. Federal Trade Commission later charged the company, which became 1Health.io, with failing to protect genetic and health data. The FTC said the company had been warned about the exposed data before and only secured it after a security researcher reported it in 2019. Counts differ by source: coverage in 2019 said more than 3,000 files, while the FTC's account refers to roughly 2,400 health reports.
Sources checked: consumer.ftc.gov, amp.insurancejournal.com, hipaajournal.com
Last verified against the official page:
What was exposed
Reports list full names, dates of birth and gene-based health information, such as likelihood of developing certain conditions. Vitagene said no credit card or other financial details were exposed. Genetic data can't be changed like a password, so the realistic risks are phishing that references your health and misuse of a name and birthdate.
What to do if you were in it
- 1
Expect health-themed phishing
Be wary of emails, texts and calls that mention DNA tests, health results or insurance. Contact the company through its official site, not through a link in the message.
- 2
Watch for misuse of your name and birthdate
If you're worried about identity theft, consider a credit freeze at Equifax, Experian and TransUnion. The FTC explains how in its guide to credit freezes and fraud alerts. It's free.
- 3
Follow the FTC's steps after a breach
The FTC's data breach guidance covers what to do depending on what was exposed, and IdentityTheft.gov is where to report misuse.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see if your email address or phone number shows up in known breaches. Serus can't remove breach data, but it alerts you and tells you what to do.
Official filings
- California Attorney General , filed 6 Aug 2019
Timeline
-
The breach happened
-
Reported to the California Attorney General
Frequently asked
Was I affected by the Vitagene breach?
Vitagene said a small fraction of customers from 2015 to 2017 may have been affected. If you used it then, contact the company, now called 1Health.io.
What was exposed?
Reports list names, dates of birth and gene-based health information. Vitagene said no credit card or financial data was exposed.
Did the FTC take action?
Yes. The FTC charged the company, later renamed 1Health.io, with failing to protect genetic and health data.
Sources
- consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts
- consumer.ftc.gov/consumer-alerts/2022/10/have-you-been-affected-data-breach-read
- amp.insurancejournal.com/news/national/2019/07/12/531982.htm
- hipaajournal.com/ftc-fines-genetic-testing-company-for-data-privacy-and-security-failures/
Something wrong or out of date? Tell us and we'll re-check it.
