Threat actor claims full access and genetic data of Singapore genomics firms
A threat actor is advertising what they claim is full corporate access to Singapore firms Imagene Labs and Asia Genomics: about 110 GB of raw genetic data, about 8.8 GB of customer PII from production databases (2018 to 2021), and admin access to the companies' AWS cloud, including 69 storage buckets and email sending. The companies have not confirmed an incident and the claim is unverified, according to DailyDarkWeb. Customers should be wary of unexpected messages about DNA test results or accounts.
What happened
A threat actor is advertising full access to Singapore genomics firms Imagene Labs and Asia Genomics. The package would include about 110 GB of genetic data, about 8.8 GB of customer PII from 2018 to 2021, and admin access to the companies' AWS cloud. The companies have not confirmed an incident and the claim is unverified.
Why it matters
Genetic data cannot be changed or reset like a password: such a leak is permanent for the customer. The claimed cloud and email access could enable phishing that appears to come from the companies. Anyone who used DNA tests from these brands is among the potentially affected.
What to do
The companies should immediately review AWS access, the 69 buckets, Shopify tokens, SSH keys and cited secrets, and revoke anything still active. Review access and email logs. Warn customers about fraudulent messages about DNA results.
For the technical team
- Affected
- Imagene Labs; Asia Genomics Imagene Labs e Asia Genomics, empresas de genômica de Cingapura e marcas relacionadas; alegado acesso corporativo total · Imagene Labs and Asia Genomics, of Singapore, plus related brands (alleged).
- Exploitation
- No exploitation reported. Sale advertised by a threat actor, reported by DailyDarkWeb; the companies have not confirmed an incident.
- Fix
- No fix applicable (alleged leak). Mitigation noted by the source: revoke active keys, secrets and tokens and treat cloud access as compromised until verified.
- Vector
- Initial compromise vector not stated in the source. The actor claims admin access to AWS (69 storage buckets and email sending), source code, SSH keys, secrets for databases and integrations, and active Shopify admin tokens.
- More details
- PII would come from production databases from 2018 to 2021. DailyDarkWeb classifies this as an unverified threat-actor claim, not confirmation of a breach, and warns that email access could enable phishing that appears official.
Timeline
Threat actor advertises full corporate access and genetic data from both companies.
Sources 1 source
- @DailyDarkWeb @DailyDarkWeb
