MyHeritage DNA Says Info Of 90M+ Users Found On Private Server

The genealogy website MyHeritage DNA revealed that email addresses and hashed password of more than 90 million users who had signed up for the website since Oct. 26, 2017 were found on a private server outside of MyHeritage.

According to the company, a security researcher informed the company on Monday that he had found a file containing the information on a private server and MyHeritage confirmed that the information originated from their website. MyHeritage said it does not store users' actual passwords but rather a one-way hash of each password and the hash key differs for each user. MyHeritage said anyone who gained access to the passwords does not have the actual passwords.

In total, the email addresses and hashed password of 92,283,889 were on the private server.

"There has been no evidence that the data in the file was ever used by the perpetrators," MyHeritage said in a statement. "Since Oct 26, 2017 (the date of the breach) and the present we have not seen any activity indicating that any MyHeritage accounts had been compromised.

"We believe the intrusion is limited to the user email addresses. We have no reason to believe that any other MyHeritage systems were compromised. As an example, credit card information is not stored on MyHeritage to begin with, but only on trusted third-party billing providers (e.g. BlueSnap, PayPal) utilized by MyHeritage. Other types of sensitive data such as family trees and DNA data are stored by MyHeritage on segregated systems, separate from those that store the email addresses, and they include added layers of security. We have no reason to believe those systems have been compromised."

MyHeritage said it is investigating the incident. Any users with concern can contact MyHeritage via email at privacy@myheritage.com or by phone at 1-888-672-2875. MyHeritage also recommends that all users change their passwords.

Photo via Shutterstock