Ancestry updates Terms and Conditions and Privacy Statement

Ancestry (www.ancestry.co.uk) has updated its terms and conditions:

Your privacy is important to us     

At Ancestry®, protecting our customers’ privacy and being good stewards of your data is our highest priority.

As part of our commitment to you, we annually review and update our Terms and Conditions and Privacy Statement. As of August 3, 2021, here are a few changes you should know about:     
• Information related to what happens with AncestryHealth® customers’ data since AncestryHealth® has been discontinued effective August 1, 2021.    
 
• Clarifications about intellectual property rights.    
 
• Clarifications about the types of privacy rights and choices you may have, depending on the location where you live.    
 
None of these updates will impact your ability to continue to use Ancestry®.

You can rest assured that Ancestry’s relationship with our customers—and our robust consumer privacy protections—remain the same.     

We invite you to review our updated Terms and Conditions and Privacy Statement now.

Thank you for being an Ancestry® customer.  

The revised Terms and Conditions available at https://www.ancestry.co.uk/cs/legal/termsandconditions, and its new Privacy Statement is at https://www.ancestry.co.uk/cs/legal/privacystatement.

UPDATE: The new terms give Ancestry the non-revocable right to use in perpetuity any content you may wish to add to your Ancestry account. The Legal Genealogist Judy Russell analyses the changes at www.legalgenealogist.com/2021/08/04/one-big-change-at-ancestry/. 

Chris

Just out, Sharing Your Family History Online is on sale at https://bit.ly/SharingFamHist. Tracing Your Scottish Family History on the Internet, at http://bit.ly/ChrisPaton-Scottish2 is also out, as are Tracing Your Irish Family History on the Internet (2nd ed) at http://bit.ly/ChrisPaton-Irish1 and Tracing Your Scottish Ancestry Through Church and State Records at http://bit.ly/ChrisPaton-Scotland1. Further news published daily on The Scottish GENES Facebook page, and on Twitter @genesblog.

MyHeritage reaffirms commitment to not license or sell genetic data to third parties

MyHeritage (www.myheritage.com) has announced an update to its privacy policy for users, strengthening its protections over the ownership of genetic data. The following is the announcement just issued by email:

Earlier this year, prior to MyHeritage’s acquisition by leading private equity firm Francisco Partners, we issued a press release in which we promised to expand MyHeritage's strong privacy framework for the benefit of our users.

The current updates to our Privacy Policy fulfill this promise. The highlight of the updates is the unequivocal commitment not to license or sell genetic data to any third party. This is highly unique among the larger genealogy and consumer DNA industry and is a testament to the commitment that both MyHeritage and Francisco Partners share to privacy and consumers. 

The updated privacy policy is available to read at https://www.myheritage.com/privacy-policy, and states its key privacy principles as follows:

Our Key Privacy Principles

MyHeritage was founded in 2003 and has enjoyed the trust of its users for 18 years. MyHeritage cares deeply about the privacy of its users and the privacy of their data and its top priority is to honor their trust.

MyHeritage has never sold or licensed personal data (like customer names, email addresses, residence addresses and family trees) and will never do so in the future.

MYHERITAGE HAS NEVER SOLD OR LICENSED GENETIC DATA OR HEALTH DATA, AND WILL NEVER DO SO IN THE FUTURE.

MyHeritage will never provide data to insurance companies under any circumstances. MyHeritage prohibits law enforcement use of its DNA Services.

Users can delete their data from MyHeritage at any time. Deletion is permanent and irreversible.

If anything material ever changes in this privacy policy, we will notify you by email.

(With thanks to MyHeritage via email)

Chris

Just out, Sharing Your Family History Online is on sale at https://bit.ly/SharingFamHist. Tracing Your Scottish Family History on the Internet, at http://bit.ly/ChrisPaton-Scottish2 is also out, as are Tracing Your Irish Family History on the Internet (2nd ed) at http://bit.ly/ChrisPaton-Irish1 and Tracing Your Scottish Ancestry Through Church and State Records at http://bit.ly/ChrisPaton-Scotland1. Further news published daily on The Scottish GENES Facebook page, and on Twitter @genesblog.

Gedmatch site now back up again

Gedmatch (www.gedmatch.com) is now back up and running again, following its recent decision to temporarily take the site down after a fairly serious privacy breach (see https://scottishgenes.blogspot.com/2020/07/gedmatch-fiasco-continues.html and https://scottishgenes.blogspot.com/2020/07/myheritage-platform-attack-possibly.html). The following message is available at the top of the page:

We have completed a thorough review of the site for security vulnerabilities and have made changes where appropriate to ensure the security of your data. If you note any issues that are of concern, please submit a request tracker ticket for resolution. For our Tier 1 members we will be extending your membership by 1 week. 

Comment: I have now finally been able to delete my account.

Chris

My next 5 week Scottish Research Online course starts August 31st - see https://www.pharostutors.com/details.php?coursenumber=102. My book Tracing Your Scottish Family History on the Internet, at http://bit.ly/ChrisPaton-Scottish2 is now out, also available are Tracing Your Irish Family History on the Internet (2nd ed) at http://bit.ly/ChrisPaton-Irish1 and Tracing Your Scottish Ancestry Through Church and State Records at http://bit.ly/ChrisPaton-Scotland1. Further news published daily on The Scottish GENES Facebook page, and on Twitter @genesblog.

Ancestry advises users to change password if using Family Tree Maker

There has seemingly been another breach of privacy, this time by Software Mackiev (www.mackiev.com), producer of the popular Family Tree Maker software programme, with which users can sync information to their online family tree on Ancestry (www.ancestry.co.uk). It seems that the company has exposed to access information for some 60,000 users thanks to a misconfigured cloud server - the full story is at https://www.infosecurity-magazine.com/news/genealogy-software-maker-exposes/ and https://www.wizcase.com/blog/mackiev-leak-research/.

In response, Ancestry has announced the following:

We have been alerted to a potential security vulnerability at the MacKiev Company, which owns Family Tree Maker software. While we no longer have formal affiliation with the company, Family Tree Maker is used by some Ancestry customers to sync family trees between Family Tree Maker software and Ancestry. Based on our investigation, we do not believe that any Ancestry systems or data have been compromised. The Ancestry-Family Tree Maker sync uses OAuth2, a widely- used authentication protocol to provide Family Tree Maker permission to access Ancestry resources without exposing user passwords.

As a best practice, we recommend Ancestry customers who have used their Ancestry credentials to access Family Tree Maker software change their password and enable two-factor authentication.

(Source: https://blogs.ancestry.com/ancestry/2020/07/22/ancestry-security-team-confident-family-tree-maker-vulnerability-has-not-impacted-ancestrys-systems/)

This looks like it could become one of those weeks...

Chris

My next 5 week Scottish Research Online course starts August 31st - see https://www.pharostutors.com/details.php?coursenumber=102. My book Tracing Your Scottish Family History on the Internet, at http://bit.ly/ChrisPaton-Scottish2 is now out, also available are Tracing Your Irish Family History on the Internet (2nd ed) at http://bit.ly/ChrisPaton-Irish1 and Tracing Your Scottish Ancestry Through Church and State Records at http://bit.ly/ChrisPaton-Scotland1. Further news published daily on The Scottish GENES Facebook page, and on Twitter @genesblog.

MyHeritage phishing attack possibly related to Gedmatch breach

Email received this morning from Gedmatch (www.gedmatch.com):

Dear GEDmatch member,

On the morning of July 19, GEDmatch experienced a security breach orchestrated through a sophisticated attack on one of our servers via an existing user account. We became aware of the situation a short time later and immediately took the site down. As a result of this breach, all user permissions were reset, making all profiles visible to all users. This was the case for approximately 3 hours. During this time, users who did not opt-in for law enforcement matching were available for law enforcement matching, and, conversely, all law enforcement profiles were made visible to GEDmatch users.

On Monday, July 20, as we continued to investigate the incident and work on a permanent solution to safeguard against threats of this nature, we discovered that the site was still vulnerable and made the decision to take the site down until such time that we can be absolutely sure that user data is protected against potential attacks. It was later confirmed that GEDmatch was the target of a second breach in which all user permissions were set to opt-out of law enforcement matching.

We can assure you that your DNA information was not compromised, as GEDmatch does not store raw DNA files on the site. When you upload your data, the information is encoded, and the raw file deleted. This is one of the ways we protect our users’ most sensitive information.

Further, we are working with a leading cybersecurity firm to conduct a comprehensive forensic review and help us implement the best possible security measures. We expect the site will be up within the next day or two.

We have reported the unauthorized access to the appropriate authorities and continue to work toward identifying the individuals responsible for this criminal act.

Today, we were informed that MyHeritage customers who are also GEDmatch users were the target of a phishing scam. Please remember to exercise caution when opening emails and clicking links. Never provide sensitive information via email. If an email seems suspicious, contact the company in question directly through the phone number or email address listed on their website, not via a reply to the suspicious email. You can reach GEDmatch at gedmatch@verogen.com or (858) 285-4101. At this time, we have no evidence to suggest the phishing scam is a result of the GEDmatch security breach this week. We are continuing to investigate the incident.

Please be assured that we take these matters very seriously. Our Number 1 responsibility is to protect the data of our users. We know we have not lived up to this responsibility this week, and we are working hard to regain your trust. We apologize for the concern and frustration this situation has caused.

Sincerely,

Brett Williams
CEO, Verogen Inc.

And an announcement from MyHeritage (www.myheritage.com), via its blog at https://blog.myheritage.com/2020/07/security-alert-malicious-phishing-attempt-detected-possibly-connected-to-gedmatch-breach/:

We want to alert MyHeritage users about a malicious attempt to steal credentials that we identified several hours ago and is still ongoing.

Perpetrators whose identity is unknown set up a fake website called myheritaqe.com (same as MyHeritage, but with the letter Q instead of the letter G). They started setting up this fake website yesterday, July 20, 2020 according to whois information, which is the date on which this domain was created and registered. They used an anonymity service to hide their identity. They exploited the fact that it’s hard to differentiate between the letters q and g, especially on mobile phones.

We immediately reported this phishing website to GoDaddy.com to have its domain removed and GoDaddy.com are in the process of taking it down. We also reported it to Azure where it is hosted so they could remove it too.

On the fake website, myheritaQe.com, the perpetrators set up a phishing login form to receive login information intended for MyHeritage and harvest the password. The website was made to look like part of the real MyHeritage.com homepage, with all the functionality not working except the fake login. It tries to impersonate the real website.

The perpetrators then started sending a phishing email to email addresses that they apparently compromised from GEDmatch. We don’t know if they emailed (or intend to email) all the users of GEDmatch or only those who uploaded DNA data to GEDmatch that originated from MyHeritage. What we found with all the users they did email, after speaking with these users, is that those users are all using GEDmatch. Because GEDmatch suffered a data breach two days ago, we suspect that this is how the perpetrators got their email addresses and names for this abuse.

One of the users who reported the phishing email had the email copy addressed to another unique name that is not associated with his account on MyHeritage, and that name does not exist on MyHeritage, but it’s the name associated with his account on GEDmatch, which strengthens our suspicion that the account details for phishing were retrieved by the perpetrators from GEDmatch.

The malicious phishing email sent by the perpetrators has the subject “Ethnicity Estimate v2”

For more from the MyHeritage release, including screengrabs of what to expect from the email described, visit https://blog.myheritage.com/2020/07/security-alert-malicious-phishing-attempt-detected-possibly-connected-to-gedmatch-breach/

Chris

My next 5 week Scottish Research Online course starts August 31st - see https://www.pharostutors.com/details.php?coursenumber=102. My book Tracing Your Scottish Family History on the Internet, at http://bit.ly/ChrisPaton-Scottish2 is now out, also available are Tracing Your Irish Family History on the Internet (2nd ed) at http://bit.ly/ChrisPaton-Irish1 and Tracing Your Scottish Ancestry Through Church and State Records at http://bit.ly/ChrisPaton-Scotland1. Further news published daily on The Scottish GENES Facebook page, and on Twitter @genesblog.

Privacy breach at Gedmatch?

This looks like the end of the road for my subscription with Gedmatch (www.gedmatch.com). DNA guru Debbie Kennet has just posted on Twitter (@DebbieKennett) that there has "been a major privacy breach at GEDmatch. It appears that all kits, regardless of user preferences, have been opted in to law enforcement matching... The site now appears to be down completely". Others are reporting a similar find.

Sorry, but if this is the case, it is just not acceptable.You don't offer people a choice to opt in or out, and then flout that shortly after no matter what was decided. Even if there is an error here, I am not as confident about this site as I once was.

UPDATE: I have managed to gain access, and my Police status had a red cross through it (i.e. permission not given), but I have no idea if my account was briefly compromised and then switched back without me knowing. There is no statement from Verogen as yet. I have tried to delete my account and got the message: "The gedmatch site is down for maintance. Currently no ETA for availability."

(With thanks to Debbie)

UPDATE: See https://thednageek.com/gedmatch-goes-haywire/ and http://mstarnesai.com/worlds-largest-open-source-dna-registry-suffers-outage-and-possible-data-exposure/ for more.

Chris

My next 5 week Scottish Research Online course starts August 31st - see https://www.pharostutors.com/details.php?coursenumber=102. My book Tracing Your Scottish Family History on the Internet, at http://bit.ly/ChrisPaton-Scottish2 is now out, also available are Tracing Your Irish Family History on the Internet (2nd ed) at http://bit.ly/ChrisPaton-Irish1 and Tracing Your Scottish Ancestry Through Church and State Records at http://bit.ly/ChrisPaton-Scotland1. Further news published daily on The Scottish GENES Facebook page, and on Twitter @genesblog.

MyHeritage revises its privacy policy

From MyHeritage (www.myheritage.com):

We’re writing to let you know that we’ve updated our Privacy Policy.

We received feedback that our previous policy was too long and difficult to understand. We listened to the community, and we worked hard to address this. The updated policy is not only 40% shorter, but it’s also easier to understand and uses clearer language. There are no material changes in the updated Privacy Policy, except a few topics where we’ve made improvements for our users.

Read the updated Privacy Policy at https://www.myheritage.com/privacy-policy.

Chris

My next 5 week Scottish Research Online course starts June 8th - see www.pharostutors.com/details.php?coursenumber=102. My next book, Tracing Your Scottish Family History on the Internet, at http://bit.ly/ChrisPaton-Scottish2 is out shortly, also available are Tracing Your Irish Family History on the Internet (2nd ed) at http://bit.ly/ChrisPaton-Irish1 and Tracing Your Scottish Ancestry Through Church and State Records at http://bit.ly/ChrisPaton-Scotland1. Further news published daily on The Scottish GENES Facebook page, and on Twitter @genesblog.