Category Archives: 23andMe

What’s Changed? –  Autosomal DNA Vendor Feature Changes Since the 23andMe Data Compromise

Posted on by
16

The 23andMe customer data compromise has reverberated throughout the technology industry, not limited to DNA testing.

The 23andMe compromise has provided the impetus for reflection and security and policy reviews at each DNA testing vendor.

That’s a good thing.

What has been and remains challenging is keeping track of which features have been disabled and are no longer available at each vendor as the vendors, including 23andMe, attempt to right themselves from this blow. Unfortunately, or maybe fortunately, we can’t just return to “business as usual.”

Some of these feature removals may only be paused, and a few have already returned. Some may never be resumed.

We don’t really know yet.

If you’re having trouble keeping track, welcome to the club.

The features that have been disabled are features that were exploited at 23andMe or could have been exploited by bad actors who signed on “as you,” exposing not only your data but that of your matches in one way or another.

To be very clear, there was no data leak or compromise at any other vendor, but some other vendors provide(d) similar features for their customers. Every vendor offering DNA testing to genealogists had to stop, pause, and reevaluate their security measures. That’s exactly what they should have done. Genetic genealogy is a team sport where compromising one person’s account exposes at least some information about thousands more individuals.

Every company has proceeded somewhat differently based on how their features work.

I’ve compiled a chart listing the four primary vendors alphabetically, with affected features.

The Scorecard

In this chart, “Not available” means the feature was available before the 23andMe incident but is not currently available.

Feature 23andMe Ancestry FamilyTreeDNA MyHeritage
Two-factor Authentication (2FA)[1] Required Required Will be required for project administrators and available for all users[2] Will be required soon.
Forced Password Reset Yes No May be required for project administrators. Yes
Match information download[3] Not available Never was available Not available until after 2FA implementation Not available
Matching segment download[4] Not available Never was available Not available until after 2FA implementation Not available
Shared matches[5] Not available Available[6] Available Available
Shared matches who match each other Not available Never was available Available thru Matrix, but not segments Partially available through triangulation
Shared matches match segments Not available Never was available Never was available Never was available
Shared matches relationship to each other Not available Never was available Never was available Predicted available
Triangulation Not available Never was available Available[7] Available
Chromosome Browser Not available Never was available Available Available
Daily matching or browse rate limited[8] No No No Yes
Shared ethnicity with matches[9] Not available Available Available by opt-in Not available
Filter matches by ethnicity Never was available Never was available Never was available Not available

 
Accepts 23andMe DNA file uploads Not applicable Never was available Paused Not restricted but not available because 23andMe does not currently allow the download of your raw data file

Other features remain unchanged, so they are not mentioned.

I think I accounted for everything that has changed, including some features already resumed at MyHeritage.

23andMe has not stated if or when they will return any of the functionality that has been removed.

FamilyTreeDNA plans to return their paused features after 2FA has been implemented in early 2024.

Please note that this information may change at any time.

_____________________________________________________________

Follow DNAexplain on Facebook, here.

Share the Love!

You’re always welcome to forward articles or links to friends and share on social media.

If you haven’t already subscribed (it’s free,) you can receive an email whenever I publish by clicking the “follow” button on the main blog page, here.

You Can Help Keep This Blog Free

I receive a small contribution when you click on some of the links to vendors in my articles. This does NOT increase your price but helps me keep the lights on and this informational blog free for everyone. Please click on the links in the articles or to the vendors below if you are purchasing products or DNA testing.

Thank you so much.

DNA Purchases and Free Uploads

Genealogy Products and Services

My Book

Genealogy Books

Genealogy Research

[1] There has been a great deal of gnashing of teeth surrounding 2FA and how it’s implemented at each vendor. If you experience issues, please contact the vendor in question.

[2] At FamilyTreeDNA, testers utilize a kit number as their username, not their name or email. No place is the kit number publicly associated with the user’s name. In the 23andMe breach, the user’s email and passwords had been exposed in earlier breaches, so the hacker simply tried the same username and password at 23andMe, with great success. That scenario cannot occur at FamilyTreeDNA because the username is not their email address, which is why 2FA is not required for users. Administrators can select their username, so they will be required to utilize 2FA soon.

[3] This means information about your DNA matches other than your matching segments, such as email address, maternal or paternal matches, notes, surnames, and other relevant information.

[4] Matching segment information for each match. Used for triangulation, ancestor identification, and at DNAPainter.

[5] Shared matches between you and another match.

[6] Ancestry has recently announced that they will require a membership to view several features available with a DNA test, including Common Ancestors (ThruLines), Notes, Trees, Groups, and filtering matches by unviewed status. These features will not be available to DNA testers without an Ancestry subscription.

[7] Available if maternal/paternal matching is enabled. When matching, each individual who matches the tester and other testers and is bucketed on the same maternal/paternal side will triangulate on at least one segment.

[8] This is to prevent data scraping if a bad actor gains access to your account.

[9] The 23andMe data was reported to have focused on both Jewish and Chinese customers

23andMe Concludes Their Investigation – 6.9 Million Customers’ Data Exposed

Posted on by
27

On October 10th, 23andMe filed a document with the SEC stating that a “threat actor” (hacker) had accessed about 0.1% of their user accounts. That amounts to about 14,000 compromised users, according to their May 2023 earnings report where they state that they have about 14 million users. In addition, the hacker accessed their matches, and potentially matches of matches, through DNA Relatives.

I wrote about the initial compromise in three articles as information unfolded.

  1. 23andMe User Accounts Exposed – Change Your Password Now
  2. The 23andMe Data Exposure – New Info, Considerations and A Pause Strategy
  3. 23andMe: DNA Relatives, Connections, Event History Report and Other Security Tools

I expected that 23andMe would provide additional information directly to their customers as their investigation proceeded and concluded.

They have not published a new blog article nor notified customers directly.

They updated their original October 6th blog article on both December 1st and 5th, stating that their investigation has concluded and the results.

23andMe stated that:

  • They have concluded their investigation and will be notifying affected customers as required by law.

This is a bit confusing because they already HAD notified many people of the original compromise event, that their data had been affected, and forced a password reset. I’m unclear whether this means an additional notification will be sent, or that the earlier notification is what they were referencing.

I’m also curious about the “as required by law” comment, as laws vary widely between countries and even states sometimes. Are they only notifying people to the extent required by law where the customer lives? This would seem both impractical and confusing when some people receive breach notices, and others do not when both are equally affected. Or is 23andMe trying to say they are complying with applicable laws?

  • They verified that the compromise was via credential stuffing, where names (email addresses, in this case) and passwords exposed in previously compromised websites were used to sign into 23andMe accounts.
  • In addition to the entire account information of those 14,000 compromised individuals, all of their DNA Relatives (matches) and information about those relatives were exposed and scraped. In other words, all of your matches and everything you could see about them.

This is also confusing because, in additional details, 23andMe states that the hacker (threat actor) “used the compromised credential stuffed accounts to access the information included in approximately 5.5 million DNA Relatives profiles and 1.4 million Family Tree features profiled, each of which were connected to the compromised accounts.”

The math doesn’t add up. Every test (account) has one AI-generated family tree. If 1.4 million family trees were exposed, and each fully compromised account has one family tree, doesn’t that mean that (minimally) 1.4 million accounts were exposed, not 14,000? That’s 100 times more than 14,000 accounts. Is the decimal in the wrong place?

Is 23andMe perhaps counting the number of people in those trees? I find it difficult to believe that everyone’s trees have 100 people. Mine only has 15 people, and all of them are my highest matches on my DNA Relatives match list, so they are already included in that breach number of 5.5 million. Assuredly, 23andMe is not double counting exposed individuals, so they would not be counted in both places.

Adding together 1.4 million family trees and 5.5 million exposed DNA Relatives, a total of 6.9 million customers have had data exposed in this breach. Apparently,1.4 million people were directly exposed, or their trees could not have been exposed because no one can see your 23andMe-provided tree other than you, and 5.5 million exposures via DNA Relatives matching. Exposed information would have also included your matches matching each other, even if their accounts were not directly compromised.

6.9 million is approximately half of the 23andMe 14 million total customers.

What 23anMe doesn’t say is how many customers, of the 14 million total, actually participate in DNA Relatives. Many of their customers only test for health and traits information, and do not opt-in to DNA matching. Those customers would NOT have trees generated, so would NOT be included in that 1.4 million trees generated, nor the 5.5 million exposed DNA Relatives. Those customers would be in addition to those numbers.

To be clear, you can’t assume that you’re in the clear just because you’re not using the genealogy aspect of 23andMe. Of course, it’s very unlikely that any customers not involved with genealogy will ever see this article.

Protections

23andMe has implemented additional industry-standard security protections for customers to prevent a recurrence.

  • Forced password reset.
  • Added two-factor authentication (2FA) that they are calling both 2SV, two-step verification, and MSV, multiple-step verification, which you can read about in their blog post, here.
  • Provided a Privacy and Security Help Center, here.

Why This Matters

I realize that many people are very unhappy about 2FA, MFA, or 2SV, which are different names for the same thing. However, given the magnitude of this exposure, it’s the responsible step for 23andMe to take.

Those techniques are based on something you know plus something you have or have access to. The something you know is your sign-in and password, and the something you have access to is your phone or email to retrieve a code. A bad actor, unless they stole your phone or have also compromised your email account, won’t be able to obtain the six-digit 2FA number mailed or texted to you.

I know this is somewhat inconvenient, but I’d like to explain why this level of security matters.

Let me give you a brief example. Let’s say that I’m a Jewish person, and the threat actor is interested in harming Jewish people. Based on my ethnicity, I can be clearly identified as Jewish. Therefore, my children and closest relatives can also be identified as Jewish. The tree generated by 23andMe tells the hacker how people fit together, and my closest relatives are clearly identified.

Their names are exposed along with, potentially, their locations, photo, birth year, and other clearly personally identifying information.

Don’t want to think about this in terms of Jewish people? Think about it in terms of any “us versus them” discriminatory situation or even in terms of a domestic violence perpetrator or a stalker gaining access to your children’s information.

Now think about identity theft, which seems benign in comparison to your safety and being targeted, but identity theft is still a very real threat and can wreck your life.

The bad actor (and anyone who buys the compromised data – your information) has enough information to do serious harm, one way or another, depending on their motives, to every person whose information they obtain.

That information may be for sale on the dark web or in some data dump somewhere. We don’t know and will never know who has it and their motivation for obtaining it.

Even if you don’t personally care what is exposed about you – due to trees and matches and information that is typically NOT exposed publicly – you’re connected via matching to OTHER PEOPLE whose data has been exposed because they match you – and your data was breached. Like it or not, we’re all in this together.

Genetic genealogy is a team sport. That’s why we love it. That’s why the hacker loves it, too. So do the hacker’s “customers.”

Most websites have moved or will be moving to 2FA shortly. All “social sites” where people interact with each other one way or another are major targets and are moving in the 2FA direction, too. Just this past week, a dear friend’s entire Facebook account was hacked and subsequently permanently disabled, meaning it’s gone, forever, all within 15 minutes. He lost 11 or 12 years of his life, journaled, along with MANY family and other photos that are no longer on his phone or anyplace else.

All of this pales in comparison to what would happen to your bank account, retirement account, or other financial vehicles. If someone reuses passwords in multiple locations, they are likely to continue the behavior across several accounts because they want to be able to remember the password. This increases the chances DRAMATICALLY of becoming a victim.

2FA is a new way of life that protects us all, and yes, it’s inconvenient, but then again, so are seat belts, and everyone wears those.

Don’t blame the companies who are trying to keep us safe, often in spite of ourselves. Companies certainly don’t relish the idea of angering or inconveniencing their customers, which is probably why they didn’t do it sooner. Blame the bad actors who necessitate this step.

Terms of Service Change

While 23andMe didn’t directly notify customers about the results of their investigation, that it is over, or the people whose accounts were directly compromised – they have sent emails about a change in their terms of service (TOS).

23andMe has upgraded their TOS (terms of service), here, to include mandatory arbitration of disputes, which precludes jury trials or class action lawsuits. In all caps, no less.

And yes, if you’re wondering, class action lawsuits have now been filed in both the US and Canada.

I’m not a lawyer, but based on the language, the new TOS appear to affect all 23andMe customers going forward UNLESS YOU NOTIFY 23andME OTHERWISE.

I received this email on December 5th for one of the tests I manage, and it states that the updated TOS go into effect in 30 days UNLESS YOU NOTIFY 23andME, in which case you will be held to the earlier terms.

Here’s the applicable section, as provided by 23andMe in the Dispute Resolution portion of their TOS, here.

If you do NOT agree, click the “notify us” link in the email, which opens a new email to legal@23andme.com to notify 23andMe.

Remaining Unanswered Questions

23andMe stated that they learned about this breach in early October, but as reported in my earlier articles, some of their customers’ data was reportedly available for sale as early as August 2023. 23andMe does not mention this, so we don’t know if that is a different breach, or if those numbers are included in the 6.9 million 23andMe customers whose accounts have been compromised.

I’d like to know if my account was actually compromised, meaning signed in to, or was my account compromised solely through DNA Relatives matching? It makes a difference in terms of how much of my and my family’s information is exposed.

I assumed that 23andMe would provide people with additional information, but to the best of my knowledge, they have not. Has anyone received an email telling you that your account was personally compromised, meaning signed in to? My notification from 23andMe and the others I’ve seen all say the same as mine, sent in late October, below.

After further review, we have identified your DNA Relatives profile as one that was impacted in this incident. Specifically, there was unauthorized access to one or more 23andMe accounts that were connected to you through DNA Relatives. As a result, the DNA Relatives profile information you provided in this feature was exposed to the threat actor.

Based on our investigation so far, we believe only your DNA Relatives profile attributes were exposed.

Did anyone receive an email that says their account was one of those directly compromised, meaning NOT through DNA Relatives?

Return of Features

Many people have been asking about the return of features that were “temporarily” disabled.

  • Relatives in Common – shared matching, meaning three-way matching
  • Your matches matching with each other, or not
  • Triangulation through Relatives in Common – meaning shared common segments
  • Matches Download File, both including and excluding segments
  • Chromosome browser

Sadly, 23andMe has provided no update on this topic.

Unfortunately, these features include nearly all of the tools that genealogists use, except for individual matching, the 23andMe-created genetic tree, and haplogroups.

We’ve lost the ability to determine how our matches match us through shared matching or triangulation. We now have no way to determine which side, maternal or paternal, a match is on because we can’t tell who else they match or “how” we match them.

I know that genealogy hasn’t been a priority for 23andMe for some time. Medical research is their focus. On October 30th, 2023, 23andMe signed another $20 million one-year deal, plus potential future drug royalties, with GSK for access to the 23andMe database of customers who have consented to medical research.

Genealogists have been an important source of testers in the past because many opted-in for medical and drug research. However, unless 23andMe returns the genealogy functionality, they’ve removed nearly all incentives for genealogists to test there.

If genealogists can’t do genealogy, why would genealogists purchase or recommend their test?

I’m glad I did not repurchase the updated DNA test that would allow me to subscribe to a premium membership to receive 5000 matches instead of 1500 matches. Initially, that membership required purchasing a new test, plus $29 per year, but the membership has now been raised to $69 per year. In August 2023, when their original agreement with GSK expired, 23andMe raised their test prices and laid employees off. I wrote about the August changes here.

Of course, that was about the same time as the original August data exposure, which was followed by the October data exposure, assuming those are two discrete events. 23andMe was clearly experiencing significant financial difficulties, and the 1-2 million spent on the data exposure investigation would have added to those woes.

Regardless, without tools, matches simply aren’t useful. There has been no mention of refunds to people who have subscribed and cannot effectively use the higher level of matches they are receiving. Those of us who haven’t subscribed can’t use ours either.

At this point, 23andMe would be my last testing choice of the four major vendors. I probably wouldn’t recommend them unless someone is searching for an immediate family match, such as an unknown parent or close relatives, and has been unsuccessful elsewhere. Without genealogy tools, unless 23andMe can place a match in the genetic tree they provide, or the match is either very close or previously known, there’s no way to determine how you are related.

Clearly, the investigation and security measures had to be their #1 priority, and patience was in order. But now that the investigation is complete, I hope 23andMe gets this straightened out, returns functionality, and provides additional information to their customers soon. 

______________________________________________________________

Sign Up Now – It’s Free!

If you appreciate this article, subscribe to DNAeXplain for free, to automatically receive new articles by email each week.

Here’s the link. Just look for the black “follow” button on the right-hand side on your computer screen below the black title bar, enter your e-mail address, and you’re good to go!

In case you were wondering, I never have nor ever will share or use your e-mail outside of the intended purpose.

_____________________________________________________________

Follow DNAexplain on Facebook, here.

Share the Love!

You’re always welcome to forward articles or links to friends and share on social media.

If you haven’t already subscribed (it’s free,) you can receive an email whenever I publish by clicking the “follow” button on the main blog page, here.

You Can Help Keep This Blog Free

I receive a small contribution when you click on some of the links to vendors in my articles. This does NOT increase the price you pay but helps me to keep the lights on and this informational blog free for everyone. Please click on the links in the articles or to the vendors below if you are purchasing products or DNA testing.

Thank you so much.

DNA Purchases and Free Uploads

Genealogy Products and Services

My Book

Genealogy Books

Genealogy Research

FamilyTreeDNA Provides Y DNA Haplogroups from Family Finder Autosomal Tests

Posted on by
19

Big News! FamilyTreeDNA is delivering holiday gifts early!

Y DNA haplogroups are beginning to be delivered as a free benefit to men who took the Family Finder test at FamilyTreeDNA. This is the first wave of a staggered rollout. Haplogroup results will be delivered to several thousand people at a time, in batches, beginning today.

This is no trivial gift and includes LOTS of information that can be used in various ways for your genealogy. Please feel free to share this article. The new Family Finder haplogroups are another reason to take a Family Finder test and to encourage other family members to do so as well.

How is this Even Possible?

Clearly, Y DNA is not autosomal DNA, so how is it possible to obtain a Y DNA or mitochondrial DNA haplogroup from an autosomal test? Great question!

Many autosomal DNA processing chips include a limited number of targeted Y and mitochondrial DNA SNP locations. Generally, those locations are haplogroup predictive, which is how haplogroup information can be obtained from an autosomal DNA test.

Compared to the actual Y DNA and mitochondrial DNA tests, only a small fraction of the information is available through autosomal tests. Only the full sequence mitochondrial DNA test or the Big Y-700 test will provide you with the full story, including your most refined haplogroup, additional information, and matching with other customers.

Having said that, haplogroups obtained from Family Finder provide important clues and genealogical information that will hopefully whet recipients’ appetites for learning even more.

Delivery Schedule

This first group of men to receive haplogroup results consists of testers who have purchased the Family Finder test since March 2019 when the most recent chip was put into production.

FamilyTreeDNA will be rolling haplogroups out in batches of a few thousand each day until everyone’s is complete, in the following order:

  • Family Finder tests purchased since March 2019 (their V3 chip)
  • Family Finder tests purchased between the fall of 2015 to March 2019 (their V2 chip)
  • Family Finder tests purchased from 2010 to the fall of 2015 (their V1 chip)
  • Autosomal uploads from other vendors for customers who have unlocked the advanced Family Finder features for $19

Uploaded DNA Files from Other Vendors

After the results are available for all males who have tested at FamilyTreeDNA, haplogroups will begin to be rolled out to customers who uploaded autosomal DNA files from other companies, meaning MyHeritage, Vitagene, 23andMe, and Ancestry.

To receive haplogroups for files uploaded from other vendors, the Family Finder advanced tool unlock must have been (or can be) purchased for $19. In addition to haplogroups, the unlock also provides access to the chromosome browser, myOrigins (ethnicity), Chromosome painting for myOrigins ethnicity, and ancient Origins.

Both MyHeritage and Vitagene tests are performed in the Gene by Gene lab. Those “uploads” are actually a secure business-to-business transaction, so the file integrity is assured.

Ancestry and 23andMe DNA files are downloaded from those companies, then uploaded to FamilyTreeDNA. Some people build “composite” files in the format of these companies, so FamilyTreeDNA has no way to assure that the original DNA upload file hasn’t been modified and it is a legitimate, unmodified, file from either 23andMe or Ancestry. Hence, in some situations, they are treated differently.

Both Ancestry and 23andMe utilize different chips than FamilyTreeDNA, covering different SNPs. Those results may vary slightly from results available from native FamilyTreeDNA tests, and will also vary from each other. In other words, there’s no consistency, and therefore haplogroup accuracy cannot be confirmed.

Haplogroups resulting from tests performed in the FamilyTreeDNA lab will be visible to matches and on the SNP pages within projects. They will also be used in both Discover and the haplotree statistics. This includes Family Finder plus MyHeritage and Vitagene DNA file uploads.

Tests performed elsewhere will receive haplogroups that will only be visible to the user, or a group administrator viewing a kit within a project. They will not be visible to matches, used in trees or for statistics.

At their recent conference, FamilyTreeDNA provided this slide during an update about what to expect from Family Finder haplogroups.

Today, only Y DNA haplogroups are being provided, but after the new mitochondrial tree is available, customer haplogroups are updated, and MitoDiscover (my name, not theirs) is released, FamilyTreeDNA is planning to provide mitochondrial DNA haplogroups for Family Finder customers as well. The current haplogroup estimate is late 2024 or even into 2025.

Unfortunately, some of Ancestry’s DNA files don’t include mitochondrial DNA SNPs, so some customers who’ve uploaded Ancestry files won’t receive mitochondrial haplogroups.

STR Haplogroups to be Updated

All FamilyTreeDNA customers who have taken Y DNA STR tests, meaning 12, 25, 37, 67, or 111 markers, receive predicted haplogroups. Often, the Family Finder extracted results can provide a more refined haplogroup.

When that is possible, STR test predicted haplogroup results will be updated to the more refined Family Finder haplogroup.

Furthermore, while STR results are quite reliably predicted, Family Finder results are SNP-confirmed.

Notification

When your Family Finder test has received a haplogroup or your STR-derived haplogroup has been updated, you’ll receive an email notification with a link to a short, less than 2-minute video explaining what you’re receiving.

You can also expect emails in the following days with links to additional short videos. If you’d like to watch the videos now, click here.

You can also check your results, of course. If you should have received an email and didn’t, check your spam folder, and if it’s not there, notify FamilyTreeDNA in case your email has managed to get on the bounce list.

Group project administrators will receive notifications when a haplogroup is updated for a member in a project that they manage. This doesn’t just apply to Family Finder haplogroup updates for STR results – notifications will arrive when Big Y haplogroups are updated, too.

Emails about haplogroup updates will include both the old and the updated haplogroup.

Haplogroups may change as other testers receive results, forming a new haplogroup. The Big Y-700 test is evergreen, meaning as the Y tree grows, testers’ results are updated on an ongoing basis.

New View

Let’s take a look at what customers will receive.

In one of my surname projects, one male has taken a Family Finder test, but not the Y DNA test.

Several other men in that same paternal line, who are clearly related (including his brother), have taken Y DNA tests – both STR and the Big Y-700.

We have men who have taken the Big Y-700 test, STR tests only (no Big Y), and one with only a Family Finder test, so let’s compare all three, beginning with the man who has taken a Family Finder test but no Y DNA tests.

He has now been assigned to haplogroup I-BY1031, thanks to his Family Finder test.

Before today, because he has not taken a Y DNA test, he had no haplogroup or Y DNA Results section on his personal page.

Today, he does. Of course, he doesn’t have STR results or matches, but he DOES have confirmed SNP results, at least part way down the tree.

He can view these results on the Haplotree & SNPs tab or in Discover. Let’s look at both.

Haplotree & SNPs

By clicking on the Haplotree & SNPs link, you can view the results by variants (mutations,) as shown below, or by countries, surnames, or recommended projects for each haplogroup.

Of course, as more Family Finder results are rolled out, the more names and countries will appear on the Haplotree.

Recommended Projects

It’s easy to determine which haplogroup projects would be a good fit for people with these new haplogroups to join.

Just view by Recommended Projects, then scan up that column above the selected haplogroup. You can even just click right there to join. It’s that easy!

Results still won’t show on the public project page, because these testers don’t have STR results to display. Perhaps this will encourage additional testing in order to match with other men.

Download SNP Results

If you’re interested, you can download your SNP results in spreadsheet format.

I’m only showing four of my cousin’s positive SNPs, but FamilyTreeDNA was able to extract 358 positive SNPs to assign him to haplogroup I-BY1031.

Are Family Finder Haplogroups Better Than STR Test Predicted Haplogroups?

How do Family Finder haplogroups stack up against STR-predicted haplogroups?

Viewing the Y DNA results of related cousins who have taken STR tests, but not the Big Y-700, we see that their Y DNA haplogroup was predicted as I-M253.

We also know that the haplogroup determined by the Big Y-700 for this line is I-BY73911.

How can we use this information beneficially, and what does it mean?

Discover

Family Finder haplogroups can access Discover, which I wrote about, here.

Clicking on the Discover link takes you to your haplogroup story.

Let’s look at the new Family Finder Haplogroup Story for this tester.

Haplogroup I-BY1031 is about 3100 years old and is found in England, Sweden, the US, and 14 other countries. Of course, as more Family Finder haplogroups are provided to customers, this information will change for many haplogroups, so check back often.

Of course, you’ll want to review every single tab, which are chapters in your ancestral story! The Time Tree shows your haplogroup age in perspective to other haplogroups and their formation, and Ancient Connections anchors haplogroups through archaeology.

You can share any Discover page in several ways. This is a good opportunity to excite other family members about the discoveries revealed through DNA testing and genealogy. Prices are reduced right now with the Holiday Sale, too, so it’s a great time to gift someone else or yourself.

Compare – How Good is Good?

Ok, so how much better is the Family Finder haplogroup than the STR-predicted haplogroup, and how much better is the Big Y-700 haplogroup than the other two?

I’ll use the Discover “Compare” feature to answer these questions.

First, let’s compare the STR-predicted haplogroup of I-M253 to the Family Finder haplogroup of I-BY1031.

I clicked on Compare and entered the haplogroup I wish to compare to I-BY1031.

I-M253 I-BY1031 I-BY73199
Haplogroup Source STR Predicted Family Finder Big Y-700
Formation Year 2600 BCE 1100 BCE 1750 CE
Age – Years ago 4600 3100 270
Era Stone Age, Metal Age Metal Age Modern
Ancestral Locations England, Sweden, Germany, UK, +100 Sweden, England, US, +14 Netherlands
Tested Descendants 26,572 121 2
Branches 6779 69 0 – this is the pot-of-gold end leaf on the branch today

I created this chart to compare the major features of all three haplogroups.

The STR-predicted haplogroup, I-M253, takes you to about 2,600 BCE, or about 4,600 years ago. The Family Finder haplogroup shifts that significantly to about 1100 BCE, or 3100 years ago, so it’s about 1500 years more recent. However, the Big Y haplogroup takes you home – from 3100 years ago to about 270 years ago.

Notice that there’s a LOT of room for refinement under haplogroup I-M253. A Big Y tester might wind up on any of those 6779 branches, and might well be assigned to a newly formed branch with his test. The Family Finder haplogroup, I-BY1031, which was, by the way, discovered through Big Y testing, moved the autosomal test taker forward 1500 years where there are 121 descendants in 69 branches. The Big Y-700 test is the most refined possible, moving you directly into a genealogically relevant timeframe with a very specific location.

I-M253 is found in over 100 countries, I-BY1031 in 17 and I-BY73199 is found only in one – the Netherlands.

Based on confirmed genealogy, the common ancestor of the two men who have Big Y-700 haplogroup I-BY73199 was a man named Hendrik Jans Ferwerda, born in 1806 in the Netherlands, so 217 years ago. Of course, that haplogroup itself could have been born a generation or two before Hendrik. We simply won’t know for sure until more men test. More testers refine the haplotree, haplogroup ages, and refine our genealogy as well.

Haplogroup Comparison and Analysis

Let’s look at the Discover “Compare” feature of the three haplogroups from my family line from the Netherlands. Please note that your results will differ because every haplogroup is different, but this is a good way to compare the three types of haplogroup results and an excellent avenue to illustrate why testing and upgrades are so important.

The haplogroup ages are according to the Discover Time Tree.

Y-Adam to Haplogroup I1 I-M253 STR Haplogroup  to I-BY1031 Family Finder Haplogroup I-BY1031 Family Finder Haplogroup to BY73199 Big Y Haplogroup
Y-Adam (haplogroup A-PR2921) lived about 234,000 years ago
A0-T
A1
A1b
CT
CF
F
GHIJK
HIJK
IJK
IJ
I
M170
Z2699
L840
I1 I1
I-M253 lived about 4600 years ago
DF29
Z58
Z2041
Z2040
Z382
Y3643
Y2170
FT92441
FT45372
PH1178
BY1031 I-BY1031 lived about 3100 years ago
FT230048
BY65928
BY61100
I-BY73199 lived about 270 years ago

 All of the base haplogroups in the first column leading to Haplogroup I span the longest elapsed time, about 230,000 years, from Y-Adam to I-M253, the STR-predicted haplogroup, but are the least relevant to contemporary genealogy. They do tell us where we came from more distantly.

The second column moves you about 1500 years forward in time to the Family Finder confirmed haplogroup, reducing the location from pretty much everyplace in Europe (plus a few more locations) with more than 6700 branches, to 69 branches in only 17 countries.

With the fewest haplogroups, the third column spans the most recent 2800 years, bringing you unquestionably into the genealogically relevant timeframe, 270 years ago, in only one country where surnames apply.

If we had more testers from the Netherlands or nearby regions, there would probably be more branches on the tree between BY1031 and BY73199, the Big Y-700 haplogroup.

The second column is clearly an improvement over the first column which gets us to I-M253. The Family Finder upgrade from I-M253 to BY1031 provides information about our ancestors 3000-4500 years ago, where they lived and culturally, what they were doing. Ancient Connections enhance that understanding.

But the third column moves into the modern area where surnames are relevant and is the holy grail of genealogy. It’s a journey to get from Adam to the Netherlands in one family 270 years ago, but we can do it successfully between Family Finder and the Big Y-700.

Family Finder Matching

Given that these new haplogroups result from Family Finder, how do these results show in Family Finder matching? How do we know if someone with a haplogroup has taken a Y DNA test or if their haplogroup is from their Family Finder test?

  • All Family Finder haplogroups will show in the results for people who tested at FamilyTreeDNA as soon as they are all rolled out
  • All MyHeritage and Vitagene uploads, because they are processed by the Gene by Gene lab, will be shown IF they have purchased the unlock.
  • No Ancestry or 23andMe haplogroups will be shown to Family Finder matches

To determine whether or not your matches’ haplogroups result from a Y DNA test or a Family Finder haplogroup, on your Family Finder match page, look just beneath the name of your matches.

The first man above received the Family Finder haplogroup. You can see he has no other tests listed. The second man has taken the Big Y-700 test. You can see that he has a different haplogroup, and if you look beneath his name, you’ll see that he took the Big Y-700 test.

For other men, you may see the 67 or 111 marker tests, for example, so you’ll know that they are available for Y-DNA matching. That may be important information because you can then visit the appropriate surname project to see if they happen to be listed with an earliest known ancestor.

After the rollout is complete, If you have a male Family Finder match with no haplogroup shown, you know that:

  • They did not test at FamilyTree DNA
  • If they uploaded from MyHeritage or Vitagene, they did not unlock the advanced Family Finder features
  • Or, they tested at either 23andMe or Ancestry, and uploaded their results

You can always reach out to your match and ask.

How to Use This Information

There are several great ways to utilize this new information.

I have a roadblock with my Moore line. Moore is a common surname with many, many origins, so I have autosomal matches to several Moore individuals who may or may not be from my Moore line.

I do know the base haplogroup of my Moore men, but I do not have a Big Y, unfortunately, and can’t upgrade because the tester is deceased. (I wish I had ordered the Big Y out the gate, but too late now.)

As soon as the results are complete for all of the testers, I’ll be able, by process of elimination to some extent, focus ONLY on the testers who fall into Family Finder haplogroup of my Moore cousins, or at least haplogroup close for Ancestry or 23andMe upload customers. In other words, I can eliminate the rest.

I can then ask the men with a similar haplogroup to my proven Moore cousins for more information, including whether they would be willing to take a Y DNA test.

  • Second, as soon as the Family Finder processing is complete, I will know that all male Family Finder matches and uploads from MyHeritage and Vitagene that have paid for the unlock will have haplogroups displayed on the Family Finder Match page. Therefore, if there’s a male Moore with no haplogroup, I can reach out to see where they tested and if a haplogroup has been assigned, even if it’s from Ancestry or 23andMe and isn’t displayed in Family Finder.

If so, and they share the haplogroup with me, I’ll be able to include or exclude them. If included, I can then ask if they would consider taking a Y DNA test.

  • Third, for lines I don’t yet have Y DNA testers for, I can now peruse my matches, and my cousins’ matches for that line. See items one and two, above. Even if they don’t reply or agree to Y DNA testing, at least now I have SOME haplogroup for that missing line.

Discover will help me flesh out the information I have, narrow regions, find projects, look at ancient DNA for hints, and more.

  • Fourth, the haplogroups themselves. I don’t know how many million tests FamilyTreeDNA has in their database, but if we assume that half of those are male, some percentage won’t have taken a Y DNA test at all. We’ll be able to obtain Y-DNA information for lines where there may be no other living descendant. I have at least one like that. He was the end of the surname line and is deceased, with no sons.

I’m literally ecstatic that I’ll be able to obtain at least something for that line. If it’s anything like my example Netherlands lineage, the Family Finder haplogroup may be able to point me to an important region of Europe – or maybe someplace else very unexpected.

The Bottom Line

Here’s the bottom line. You don’t know what you don’t know – and our ancestors are FULL of surprises.

I can’t even begin to tell you how MUCH I’m looking forward to this haplogroup rollout.

To prepare, I’m making a list of my genealogical lines:

  • If the paternal line, meaning surname line, is represented by any match in any database
  • If that line is represented by a known person in the FamilyTreeDNA database and by whom
  • If they or someone from that line has joined a surname or other FamilyTreeDNA project, and if so, which one
  • If they’ve taken a Y DNA test, and what kind – watch STR results for an updated haplogroup
  • If they’ve taken a Family Finder test – my cousin is a good example of a known individual whose kit I can watch for a new haplogroup
  • Old and new haplogroup, if applicable

If my only relative from that line is in another vendor’s database, I’ll ask if they will upload their file to FamilyTreeDNA – and explain why by sharing this article. (Feel free to do the same.) A Y DNA haplogroup is a good incentive, and I would be glad to pay for the unlock at FamilyTreeDNA for cousins who represent Y and mitochondrial DNA lines I don’t already have.

One way I sweeten the pie is to offer testing scholarships to select lines where I need either the Y DNA or mitochondrial DNA of relevant ancestors. It’s a good thing these haplogroups are being rolled out a few thousand at a time! I need to budget for all the scholarships I’ll want to offer.

I feel like I won the lottery, and FamilyTreeDNA is giving me a free haplogroup encyclopedia of information about my ancestors through my cousins – even those who haven’t taken Y DNA tests. I can’t even express how happy this makes me.

What lines do you want to discover more about, and what is your plan? Tests are on sale now if you need them!

_____________________________________________________________

Follow DNAexplain on Facebook, here.

Share the Love!

You’re always welcome to forward articles or links to friends and share on social media.

If you haven’t already subscribed (it’s free,) you can receive an email whenever I publish by clicking the “follow” button on the main blog page, here.

You Can Help Keep This Blog Free

I receive a small contribution when you click on some of the links to vendors in my articles. This does NOT increase the price you pay but helps me to keep the lights on and this informational blog free for everyone. Please click on the links in the articles or to the vendors below if you are purchasing products or DNA testing.

Thank you so much.

DNA Purchases and Free Uploads

Genealogy Products and Services

My Book

Genealogy Books

Genealogy Research

23andMe: DNA Relatives, Connections, Event History Report and Other Security Tools

Posted on by
59

A few days ago, I suggested a pause strategy while you ponder whether or not you wanted to delete your DNA file in light of the recent data exposure at 23andMe. I need to revise this with additional information today.

First and foremost, disabling DNA Relatives does NOT remove all matching. You need to remove Connections separately.

Secondarily, there’s a report at 23andMe for you to order to determine whether your account may have been individually compromised. I’ve described how to find it and use the information in the report.

This article includes several sections with important information about how these intertwined features at 23andMe work and instructions to protect yourself.

  • An update on the breach situation with informational links
  • Customer notifications
  • Confusion regarding types of sharing – DNA Relatives vs Connections
  • Explaining the difference between DNA Relatives and Connections
  • Step-by-step instructions for removing Connections – disabling DNA Relatives doesn’t accomplish this or stop matching/linkage to Connections
  • Who sees what, when?
  • DNA Relatives and Connections comparison chart
  • Account Event History – how to determine when your account was signed into, from where, what they (or you) did, and when
  • Deletion instructions and caveats
  • Summary

Update on Breach Information

I’m not going to post anything from the hacker(s) – but please, in an abundance of caution, presume your data is now available publicly or will be when the hacker sells the balance of the accounts they have and act accordingly.

The hacker has posted millions of accounts already, and I know people who have found themselves in the “sample” download provided by the hacker to convince people that the breach and resulting data is for real. If you really want to see this for yourself, the hacker, Golem, is very active at BreachForums, under Leaks, 23andMe – but I DO NOT recommend hanging out there. I reached out to colleagues who work with security and breach monitoring services. I am not poking around myself.

This 23andMe customer information first appeared in August, not October, when a hacker by a different name on Hydra posted images of the accounts of both Sergey Brin and Anne Wojcicki, CEO of 23andMe and her former husband, CEO of Google. The hacker said that the information was obtained through an API provided by 23andMe to pharmaceutical companies. Additionally, the hacker said they had already sold all of that initial data to “an individual in Iran.” You can read about this here.

Furthermore, if what the hacker or hackers say is accurate, this situation is far more serious than a password recycling issue. I don’t want to speculate because I can’t verify, although many people have written to me to say two things:

  • They were seeing leaked customer information weeks earlier
  • They did use a unique password at 23andMe

Here are four additional articles that I suggest reading to understand the scope of the situation and why there’s so much uncertainty:

One of my blog readers asked why anyone would want to do this. Of course, there can be many or even multiple motivations, but based on some of the commentary, it appears that Jewish people were targeted and compiled identifying data sold to Iran who backs Hamas. If you’re a Jewish person, anyplace in the world, you have to be extremely concerned especially since this test identifies your closest relatives and (if provided) the location where you live.

Both 23andMe and Ancestry display your current location if provided and selected. I NEVER recommend doing that under any circumstances. Of course, if the hacker gained access to individual accounts as reported and you entered that information, even if you didn’t choose to share it, they have it anyway.

Customer Notification

Please note that so far, the only notifications received by 23andMe customers say that their information was revealed through DNA relatives, meaning that at least one of their matches’ accounts was compromised. No one, to my knowledge, has received a notification that their own account has been directly compromised. Perhaps 23andMe doesn’t know whose accounts were compromised yet.

Near the end of this article, I’ll show you how to obtain a list of all the activity that has taken place on your 23andMe account so you can see if there are logins from locations not your own or other suspicious activity.

According to the original announcements from 23andMe and others, the data exposure was a result of two things:

  • Direct access to accounts due to reused passwords allowing the hacker to aggregate data and sign in as the user. You can see if your email address has been found in a data breach at the site, haveibeen pwned.com. I know this list is incomplete, though, because I’ve been notified by letter by other companies not listed here.
  • DNA Relatives information shows DNA matches, segments, and your matches’ potential relationships to each other along with their shared data, permitting triangulation.

The more I read about this from credible sources, combined with how 23andMe has handled this situation, the more “uncomfortable” I become.

Before 23andMe even straightened this mess out, this week, they introduced a new “Total Health” subscription for the low price of $99 PER MONTH. Seriously. Billed as one payment of $1,188 per year. To me, this smacks of a company desperate for money.

How do we even begin to place any confidence in this service, given what has already been exposed and the unanswered questions? Especially given that for weeks, 23andMe dismissively replied to customers who informed them of the issue that their systems had not been accessed in an unauthorized manner. Not to mention, this announcement is entirely tone-deaf as we struggle to deal with what has already been exposed one way or another.

In response to this, if you still want to maintain your existing account at 23andMe, I have help for you. If you want to delete it, I’ve provided instructions for that too.

Questions and Challenges

I discovered that DNA Relatives and Connections don’t work in exactly the way I believed they did, and it’s very confusing. Nothing, not one thing that 23andme has provided has addressed exactly what information has been exposed or what customers can do other than change their password and add 2FA.

  • Was the breach only DNA Relatives, or was it Connections, too?
  • Connections is essentially a subset of DNA Relatives plus potentially some unrelated people.
  • Not everyone has DNA Relatives enabled, but if not, Connections still exposes/exposed you if your account was individually breached.
  • 23andMe only mentioned DNA Relatives, so you may think you’re in the clear if you don’t have DNA Relatives enabled. That’s inaccurate if you have any Connections and your account was individually breached.
  • If the hacker did sign on to your account, Connections are equally vulnerable.
  • The hacker could enable DNA Relatives without your knowledge to create a more lucrative fishing environment. I’ve provided instructions for how to determine if this might have happened.

Disabling DNA Relatives is not enough.

23andMe Sharing Options Are Confusing

I first reported the breach here and said in my article, here, that a pause strategy would be to stop sharing in DNA Relatives, which would effectively provide you with time to make a decision.

I knew that DNA Relatives did not unilaterally disable Connections, but I did NOT realize how much information your Connections can see.

Over the years, 23andMe has revised how their sharing works. I remember when DNA Relatives opt-in and opt-out was added in 2014. It was extremely confusing then and still is.

DNA Relatives and Connections are confusing individually and together. I could not find any feature comparison or side-by-side table for each tool, either individually,  compared to each other, or with both enabled.

Because of this confusion, what we need right now is a one-button invisibility cloak that we can click to JUST STOP being visible to everyone until we reverse the invisibility cloak by opting in again – without losing anything or being penalized.

That’s what most people think happens when you stop sharing through DNA Relatives, but it’s not.

There is no invisibility cloak at 23andMe like there is at other vendors.

No Invisibility Cloak

I spent a considerable amount of time over the past few days trying to figure out the differences between DNA Relatives and Connections.

Believe it or not, that information was almost impossible to find, as it was scattered piecemeal across several places.

Let me step you through where to find it, and then compile an easy reference.

If you sign on to your account, you can see on the left-hand side that you have several selections under DNA Relatives.

Under Connections, you have the statuses of Connected, Pending, and Not Connected.

If you mouse over Connections, you see a general description.

I have two separate tests at 23andMe, and I have DNA Relatives enabled on one of the tests and disabled on the other, so I can see the differences when compared to the same people.

I have 1803 DNA Relatives, meaning matches, but the connections option told me that 348 were also Connections.

Why Do I Have 348 Connections?

Remember that 23andMe limits your matches to 1500, and the lowest matches roll off your match list without a subscription, which was only introduced in the last year or so. The subscription only allows 5,000 matches before the matches roll off your match list.

The only way to prevent matches from rolling off your list was/is to “Connect” with them, either through DNA relatives or initiating messaging. So, for years, genealogists sent a connection request to every match they had, beginning with the smallest first, in order to preserve matches that would otherwise be gone. That’s why I have 1803 matches and not just 1500 like I do on the second account where I have not established “Connections.”

Given my number of matches at the other DNA testing companies, I would likely have well over 20,000 matches, so preserving as much as possible was important to genealogists.

Understanding Connections

I switched to a different account that I manage that opted out of DNA matching a decade ago, but has more Connections than I do with many of the same people that I match.

You can view your DNA Connections by clicking on Family & Friends and then on Your Connections.

As you can see on the left, you can either share “Ancestry” with these Connections, which means typical genealogy info, or “Health + Ancestry.” Relevant to the breach, your Ancestry Composition (ethnicity) results as compared to your Connections (and DNA Relatives) are shown.

You can invite anyone to connect with you, including people on your match list or anyone else you know who has tested. In other words, your spouse or a cousin whom you DON’T MATCH.

Here’s an example of a cousin by marriage who I’ve known for years. We connected even though we don’t match and are only related by marriage.

Some Connection invitations that you receive or send are for Ancestry only, and other invitations are for BOTH Ancestry and Health.

Melissa sent me a combined request for both Ancestry and Health.

Remember that the focus of 23andMe has always been medicine, big pharma and health. Unfortunately, 23andMe PRECHECKS to accept the Health sharing option when you’ve been invited to share Health. It’s easy to miss, so UNCHECK Health if you don’t want to share YOUR HEALTH INFORMATION. The only people I’ve ever shared Health with are my immediate family members.

What’s Different?

I wanted to know what information was different about someone you’re NOT connected with and someone you’re connected with.

One of my DNA matches, Gwen, requested a Connection. Here’s the information I can see with Gwen before her Connection request.

I verified that this information is accurate by comparing Connections requests with a family member who is opted into DNA Relatives, one who is not, and also with my research-buddy cousin who is a Connection but not a match.

Any one person can potentially be:

  • A DNA Relative and not a Connection
  • A Connection and not a DNA Relative
  • A Connection but not participating in DNA Relatives even though they are a match

Today, the information a Connection and a DNA Relative can see since 23andMe disabled some DNA Relatives features seems identical.

Gwen’s profile card shows her name, location where she lives, and year of birth, if provided and selected for display. She obviously did not allow her birth year to be displayed, but she did allow the city/state where she lives.

23andMe estimates how I may be related to Gwen and how much DNA we share..

Gwen’s family background, which I’ve blurred. I have removed my information as I ponder whether to delete my account or not.

Ancestry Composition (ethnicity) of both people. Note that even if DNA Relatives is not enabled, either person’s account can view the shared ethnicity of both accounts.

Amounts of Neanderthal Ancestry.

How Sharing Works

23andMe discussed sharing, but differentiating between DNA Relatives and Connections is unclear.

Based on my comparison and their descriptions, I think I’ve figured out the differences. Let’s begin with their description of how sharing works.

Here, they describe part of what Connections shows.

At this point, the features of DNA Relatives that were available IN ADDITION to what could be viewed in Connections have been disabled due to the breach.

The next image is part of the Connections section, followed by DNA Relatives,

I was surprised that Shared DNA was displayed using Connections alone, before 23andMe (possibly temporarily) disabled this functionality in response to the breach. I would have presumed that if you disabled DNA Relatives, your DNA would NOT have been shown to your DNA relatives.

DNA Relatives was necessary for advanced features, including viewing relationships between your matches, meaning you and two other people, and also between your matches and each other. That means you could compare them to each other.

That feature selection is now gone as well. For the record, this graphic was out of date anyway, but now it doesn’t matter.

Connections DOES have access to the tree calculated by 23andMe but (apparently) only for people you are connected with unless you have DNA Relatives enabled. Please note that all accounts managed by one person appear to be connected to each other, although that might not be universal. I manage four kits, and all of them are shown as connections to each other.

Considerations provided by 23andMe

Here’s what they don’t say.

Disabling Your DNA Relatives Option does NOT Change Connections

This is very important considering how much information Connections can view:

  • Disabling DNA Relatives does NOT disable sharing. You can disable DNA Relatives across the board with one setting, but you CANNOT do that with Connections.
  • Each Connection must be deleted individually.

After you disable DNA Relatives, as I described in this article, under the heading, “Opting Out of DNA Relatives” you need to additionally remove each Connection if you genuinely don’t want to be seen by other people as a match. If you DO want to be seen as a match, then don’t disable DNA Relatives.

DNA Relatives will eliminate new matches from automatically occurring but won’t remove anyone you’ve previously added as a Connection.

To view and edit your connections, select “Your Connections” under “Family and Friends.”

For each Connection, click on the gear, then select which type of sharing to remove.

Please note that you may have to refresh the page to reload Connections, as there is no “load more” button, until you see the message, “You aren’t connected with anyone yet.”

Connections Versus DNA Relatives Chart

If you’ve had a hard time keeping this straight, me too. I created a chart that lists each feature and if it’s present in DNA Relatives, Connections, or both.

Feature Connections Only DNA Relatives Comment
Profile Yes Yes
Current Location, Year of Birth, Genetic Sex Yes Yes If provided and selected for display
Additional info about yourself Yes Yes If provided
Prevents Rolling Off Match List at Threshold Yes No Only Connections or people you’ve initiated contact with are retained
Matches Yes, only Connections Yes
Non-Relatives Can send an invitation to people you’re not biologically related to meaning not on your match list No, only DNA matches
Ancestry Yes Yes, plus shared matches and additional information If selected
Health If selected If selected
Genetic Relationship Yes Yes Estimated
Shared DNA Percent Yes Yes
Genetic Constructed Family Tree Connections only Yes all To about 4th generation shared ancestors
Family Background – birth places of grandparents Yes Yes
Other ancestors’ birthplace Yes Yes
External Family Tree Link Yes Yes If provided
Ancestry Composition (ethnicity) Yes Yes
Shared ethnicity Yes Yes
Maternal, Paternal Haplogroups Yes Yes Base to mid-level
Neanderthal Ancestry Yes Yes
Matching segments Shown in 23andMe documentation, currently disabled Yes, currently disabled Disabled due to breach
Chromosome browser Not shown in 23andMe documentation Yes, currently disabled Disabled due to breach
Shared matches No Yes, currently disabled Disabled due to breach
Triangulation No Was changed recently to be more difficult, now disabled Disabled due to breach
Shared Matches compared to each other’s tests No Yes, currently disabled Disabled due to breach
Shared Matches relationships to each other No Yes, currently disabled Disabled due to breach
Download Matches I don’t think so, but I can’t positively confirm Yes, currently disabled Disabled due to breach
Download Segment information No Yes, currently disabled Disabled due to breach
Download Raw data file (Your own) Yes Yes

Now that you know what can be seen and done and by whom, let’s take a look at how your account has been accessed.

Account Event History – Who Signed In To Your Account?

There’s a little-known feature at 23andMe that you can utilize to view the locations of sign-ins to your account and what was done, including changes and file download requests.

Navigate to settings.

Scroll down to “23andMe Data,” then click on View.

Scroll to profile data, click on “Account Event History,” then “Request Download.” 23andMe says it may take several days, but mine was ready the following day. You’ll receive a link to sign in and download a spreadsheet. Click on the blue “Account Event History” to download the report.

At the top, you’ll see column names. Please note that I added the Location column to record the results of the “Client IP Addr” lookup.

The “Client IP Addr” field is a record of where the login was initiated from. It’s your electronic address, or more specifically, the address of your internet provider, and it may not be the exact town where you live, but someplace close. I’ve blurred mine, but not where failed logins originated.

I use this site or this site to identify IP address sources.

As you can see, on May 1, 7, and 10, someone tried to sign in with my email address. It wasn’t me or the region where I live, and I was not traveling.

I was able to track these IP addresses to cities but not to individuals, of course. One tracked to a specific Internet Service Provider in that city, but nothing more.

However, that tells me that someone tried three times to use what was probably a compromised password. Thank goodness I don’t reuse passwords.

I also need to mention that you can find legitimate differences in location. For example, if you are traveling or use tools like Genetic Affairs that sign on on your behalf from their location, the IP address will reflect connection services from those locations.

You will also see interesting IP addresses, like that 127 address. That means the host computer made the change. In essence, that means that another 23andMe user removed sharing with me. That’s clearly legitimate.

I did not see any successful sign-ins from unauthorized locations. If you see a successful sign-in from an unknown location that’s not close to your home sometime in 2022 or 2023, and you weren’t traveling, nor using a location masking tool like TOR, then please notify 23andMe immediately.

The notification email I received from 23andMe was that my information had been exposed through DNA Relatives. Based on their notification in addition to the information in my report, my personal account does not appear to be individually breached.

23andMe clearly has access to this IP address information for all users, so I’m really surprised that they have not notified anyone, at least not that I know of, that their accounts have been DIRECTLY compromised – meaning NOT through DNA Relatives. Even if someone signed on using the correct password, there could/should be some pattern of sign-ons through not-normal locations for a group of customers during this time.

Of course, if the hacker was telling the truth and the breach was NOT through password reuse (stuffing,) and was through an API, neither users nor 23andMe may see unauthorized account accesses. I hope 23andMe and the professionals they have retained are able to sniff out the difference and will update their customers soon.

Regardless, I recommend requesting and reviewing this report and implementing 2FA everyplace that you can.

Deleting Your Profile

Based on your comfort level, you may decide to delete your test at 23andMe. It’s a personal decision that everyone has to make for themselves. There is no universally right or wrong decision, and I’m not recommending either way.

Before I show how to delete your data, be aware that IF YOU MANAGE MULTIPLE PROFILES, YOU NEED TO CONTACT CUSTOMER CARE UNLESS YOU WANT TO DELETE ALL THE PROFILES.

  • If you want to delete only your profile, you can transfer other profiles under your care to someone else.
  • If you manage multiple profiles and click delete, all of the profiles you manage will be deleted.

To find the delete function, click on the down arrow by your initials at top right, then on Settings.

Scroll to the very bottom.

Click on “View,” then scroll to the bottom to the Delete Data section.

23andMe provides links in this section to review, so please do. This includes information about how to transfer profiles and things to consider.

If you want to download your raw DNA file to use as an upload to other vendors, be sure to do it before you delete, because it won’t be available after. You can find instructions, here.

Remember, delete is permanent, and you’ll need to pay to retest if you change your mind.

In Summary

I hope this information has helped organize and explain things in a logical manner.

To recap, to become totally invisible, meaning no other tester can see you:

  • Disable DNA Relatives
  • Delete Connections individually and selectively

If you delete connections and those matches are lower than your 1,500th match, they will roll off your match list unless you have a subscription, and then it’s 5,000.

Additional Tasks

  • Request your Account Event History and review for anomalies.
  • For security purposes, change your password to one you have not used elsewhere, if you have not already, and enable 2FA.

I hope that 23andMe has or will take care of whatever issues they have, post haste, and will be transparent about what actually happened. I also hope they will find a way to re-enable the tools that have been disabled. That functionality is critically important to genealogists, and without those tools and the lack of trees, there’s little reason for genealogists to test at 23andMe.

We can’t change what has already happened. Each one of us has to decide whether we want our test to remain at 23andMe and, if so, what steps we want to take to move forward successfully.

I hope this information helps you decide how to handle the situation and perhaps relieve some anxiety. Now you know how to check your activity report, understand who sees what in DNA Relatives and Connections, associated options, what needs to be done, and how to take appropriate action.

Other Vendors

You probably have observed and will continue to see other vendors implementing additional security measures, such as required 2FA, precautions against account scraping, and not accepting uploads from 23andMe in case the hacker downloaded DNA files.

These revisions may be temporary or permanent, or some of each. I’m grateful for each vendor taking steps to protect our information from unauthorized access. I’ll write more after things settle down and we better understand the new landscape.

_____________________________________________________________

Follow DNAexplain on Facebook, here.

Share the Love!

You’re always welcome to forward articles or links to friends and share on social media.

If you haven’t already subscribed (it’s free,) you can receive an email whenever I publish by clicking the “follow” button on the main blog page, here.

You Can Help Keep This Blog Free

I receive a small contribution when you click on some of the links to vendors in my articles. This does NOT increase the price you pay but helps me to keep the lights on and this informational blog free for everyone. Please click on the links in the articles or to the vendors below if you are purchasing products or DNA testing.

Thank you so much.

DNA Purchases and Free Uploads

Genealogy Products and Services

My Book

Genealogy Books

  • com – Lots of wonderful genealogy research books
  • American Ancestors – Wonderful selection of genealogy books

Genealogy Research

The 23andMe Data Exposure – New Info, Considerations and A Pause Strategy

Posted on by
75

As most of you know, 23andMe has been suffering the effects of what appears to be a significant data compromise, meaning many of their customers’ information has been compromised or exposed.

Here’s the latest news indicating that information from millions more accounts has been offered on the dark web, along with 23andMe’s latest update, here.

I’ve been trying to keep up with the changes, and I must tell you, the hacker’s quotes in that Cybernews article chill me to the bone.

Furthermore, the depth of this issue is still unfolding, with a report of an earlier August breach.

What Has Happened

Essentially, due to users who have reused and recycled passwords, a bad actor was able to sign on to many customer’s accounts, directly, acting “as” the customer, which allowed them to:

  • View (or change) personal information
  • View matches’ information
  • View matches in common
  • View triangulation information
  • View how your matches also match each other
  • View health information if you and your match have agreed to share at that level
  • View ethnicity, shared ethnicity, and ethnicity chromosome painting
  • View the family tree provided by 23andMe that provides an estimated reconstruction of your matches to you and each other to ancestors several generations into the past
  • View your profile information
  • Download your matches
  • Download your raw data file

Anything you can do or see, they could do or see because they were signed on as “you.”

That’s a lot, and I’m sure that 23andMe is struggling with how to keep their customers safe, especially since this data compromise was reportedly not due to a breach or “break-in” of their system or site, but due to social engineering failures. It’s also difficult to sort the truth from the rest.

Right now, things are moving so fast on this front that every time I have an article ready to publish, something else changes. I’m going to share what I do know, and what you can do.

Some Users Have Been Notified

I know of at least two people who have been notified by 23andMe that their data was exposed in the compromise, receiving the same email. The communication was nonspecific, partially extracted as follows.

After further review, we have identified your DNA Relatives profile as one that was impacted in this incident. Specifically, there was unauthorized access to one or more 23andMe accounts that were connected to you through DNA Relatives. As a result, the DNA Relatives profile information you provided in this feature was exposed to the threat actor.

Based on our investigation so far, we believe only your DNA Relatives profile attributes were exposed.

They did not say, nor do I know how 23andMe identified those customers.

This only applies to people whose information was partially exposed as a match to a compromised account. I don’t know if they have identified the compromised accounts and are notifying those people, too.

Given the reported magnitude of this exposure, I wonder why only two people have mentioned being informed. None of my accounts have been informed, nor those of family members.

Using Email as a User ID

Using an email address as half of your user ID essentially gives that piece of the puzzle away.

It makes users particularly vulnerable because bad actors only have to obtain the second half – a password. That’s a lot easier than you’d think.

If nothing else, this 23andMe incident illustrates just how many people engage in unsafe security practices.

Not all vendors utilize email as part of your user id, and those that do often utilize other safety practices, including but not limited to two-factor authentication (2FA.)

Forced Password Reset

Several days ago, 23andMe forced their customers to reset their passwords before signing in. Of course, by that time, millions of cows had already left the proverbial barn. Still, that was certainly the responsible thing for 23andMe to do, preventing additional damage, assuming their customers didn’t reuse yet another password.

I finally managed to reset my password, although that was anything but easy. In order to do a password reset, the standard procedure and the one 23andMe follows, is to send a reset link or key to your email address on file. However, if you changed your email, or it has been “blacklisted” because your carrier was down at some point when 23andMe tried to communicate with you, or the reset email wasn’t received for some other reason, you have to contact support to obtain assistance. Needless to say, 23andMe support is overwhelmed at this point.

23andMe has provided a Privacy and Security page, with suggestions, here.

Two-Factor Authentication

23andMe has NOT required their customers to implement two-factor authentication, known as 2FA.

They DO provide an option to enable 2FA, and I recommend that you do so. Generally, this means that every time you sign in, as part of that process, after entering your password, 23andMe will text a code to your phone or email one to you, or you can utilize a third-party authenticator application. Essentially, this adds a a third step that communicates with you through some methodology that you control, in addition to your username and password. Yes, 2FA can be a pain, but it works. You’ll find information, here.

The Relatives in Common Change Before the Compromise

I was writing about this change when all Hades broke loose with this data compromise.

A week or two prior to the compromise, 23andMe made what may have appeared to them to be “cosmetic” changes, but to genealogists, 23andMe made genealogy and triangulation much more tedious and difficult. Certainly not impossible, just requiring several steps instead of one.

Previously, Relatives in Common under DNA Overlap said “yes” or “no.” Yes meant that me, a match (Tim), and a third person (Tony) triangulated. No meant we all matched each other but no triangulation.

The 23andMe change replaced yes and no with “Compare.” That meant that customers were required to complete the following steps to get to “yes” or “no.”

  • You compared to person A (Tim)
  • You compared to person B (Tony)
  • Person A compared to person B (Tim to Tony)

It went from easy to painful, and now, since the compromise, it’s gone altogether.

Before I move on to what else has changed, I want to comment on the original change. I don’t think it’s connected to the current exposure situation, but I have no insider knowledge.

Given my background in technology, creating a permanent yes/no link means storing the relationships of each DNA segment to your matches, which quickly become a HUGE three-dimensional matrix. Storage requirements would be substantial. If you only compare three people when requested, those storage requirements disappear. Storage = $$$, and 23andMe has been struggling financially for some time.

23andMe stock is down 62% year to date, 72% since this time last year, and 92% over five years.

Based on this data, my assumption was that 23andMe was trying to save money, shaving anything anywhere it could. Genealogists were hoping to convince 23andMe to reverse their decision, but now it’s a moot point because DNA Relatives is gone altogether, at least for now, and 23andMe has much, much larger fish to fry.

23andMe Update

23andMe provided an update on their blog about changes they’ve made related to DNA Relatives, here.

However, DNA Relatives is ONLY HALF THE PROBLEM. 23andMe did not address the rest.

  1. A Direct Compromise – Your data was very clearly compromised IF YOUR ACCOUNT WAS DIRECTLY COMPROMISED. This means the situation where the bad actor was able to sign on to your account as you because your email and password were found in other data breaches. If you’ve ever reused a password, you have no way of knowing if your account was compromised and you must assume it was.
  2. Compromise Through DNA Relatives Matching – Your DNA Relatives information, as described in this 23andMe link may have been compromised, meaning revealed if ANY OF YOUR MATCHES’ ACCOUNTS WERE COMPROMISED. In other words, your information shown to a match was exposed if any of your 1500 (non-subscriber) or 4500 (subscriber only) matches had their account directly compromised – meaning signed into because they reused a password. Less of your data was compromised than in a direct exposure, but some of it very clearly would have been exposed in this scenario.

The link 23andMe provided only addresses what can be viewed through DNA Relatives. They did not mention health information if you and any specific match have authorized that level of sharing. I have not.

That’s not all, either.

If Your Account Was Directly Compromised, Your RAW DNA File Could Have Been Downloaded

If YOUR account has been signed into, the bad actor is functioning as you, and they can download your raw DNA file, which means they could upload it elsewhere. The hacker mentioned that specifically.

You do have to request a download at 23andMe. A notification is sent to your email when the download is ready, BUT, you don’t actually need that email to retrieve your download. If you simply sign out and back in again, and return to the download function, a notification awaits you that your download is now ready. Just click to download.

If your email address used at 23andMe is functioning correctly, you would have received a notification that you had requested a DNA file download. If you received a notification like this in the past few days/weeks/months, and you did NOT request a download, please inform 23andMe immediately. This could be one way that 23andMe might be able to determine whose accounts were directly compromised, and therefore whose accounts were indirectly compromised using DNA Relatives.

In my case, I was not receiving email notifications from 23andMe because my account had been blacklisted due to carrier issues, so I would never have received that email.

If your account was one that was compromised, your file may have already been downloaded. Check your inbox and spam folder to see if you have any notifications from 23andMe that escaped your notice.

It Could Still Be Happening

23andMe can only do so much.

They can force users to select a new password, but they can’t prevent people from reusing a different password, which means that the bad actor could still be trying to sign on to accounts – and getting into some.

Genealogy, including DNA is a team sport. We have to depend on our matches.

23andMe could force everyone to use 2FA, but so far they have not opted to do that, probably because it would be very unpopular.

Additional Changes

The following DNA Relatives features have either been temporarily or permanently disabled or removed:

  • Download matches (which included matching segments) is no longer available
  • Relatives in common (three-way matching) is disabled entirely, so there are no shared matches or shared segments
  • Viewing how your matches match each other is gone
  • The chromosome browser is gone

However, other tools such as the family tree which shows relationships and health sharing are still available.

At 23andMe, What Can You Do?

Truthfully, I’ve been a hair’s breadth from deleting all of my tests at 23andMe for days. I manage two tests of my own and other relatives’ too.

23andMe has never been committed to genealogy and was always the least useful site for me. Having said that, I have had some close and very useful matches there that aren’t elsewhere.

I’m certainly never testing there again, but I really don’t want to give up on 23andMe altogether, at least not yet. I’ve already paid for several tests, and I would lose valuable information today, and the potential of the same in the future.

We can’t undo any damage that has already been done. That ship has sailed. However, we can take steps to protect ourselves, both today and tomorrow. In other words, we have options other than deleting our tests.

I’ve decided to pause, at least for now.

The Pause Strategy

Only you can protect yourself by selecting a unique, strong password. Not just at 23andMe, but every site you use on the internet for any purpose.

Until and unless 23andMe requires 2FA, you need to decide on a strategy to protect yourself from other people’s negligence.

You don’t have to permanently delete your tests. Instead, you can disable DNA Relatives, which means matching.

I’ve opted-out of DNA Relatives while waiting to see what happens as 23andMe works through this quagmire. That means that I’m not participating directly in matching anymore. I’ve also opted all of the tests I manage out as well. I can always opt back in when this problem is resolved, if that ever happens.

Opting-Out of DNA Relatives

Here’s how to opt-out.

Under the Ancestry tab, select DNA Relatives.

Click on Edit profile.

Scroll all the way to the very bottom.

At the bottom, click on “I would like to stop participating in DNA Relatives.

I clicked on “Finish,” then verified that this profile is not shown as a match.

My profile prior to disabling DNA Relatives looked like this:

These same fields after disabling DNA Relatives.

Unfortunately, it does not appear that you can disable Connections broadly.

Apparently, you need to disable Connections one by one. I know that Connections can still see you, but they can’t see everything. You can find instructions here.

What I’d really like is an “invisibility” function that simply stops all sharing by making me invisible until I want to be visible again, without deleting my accounts. I’m more than a little irritated that connections remained, other than within the accounts I actually manage.

I still have not decided if I will eventually retain or delete my accounts, but disabling DNA Relatives helps somewhat and buys me some pause time while I make a final decision about 23andMe.

Your decision may not be as difficult. In addition to my genealogy research, I depend on my accounts at the various vendors for instructional articles for my blog.

Minimum Two Steps

No matter what else you do, implement the following NOW:

  1. Use a unique, difficult-to-guess, strong password at every vendor. Here and here are some ideas and guidelines for strong passwords.
  2. Turn on 2-factor authentication.
  3. If you did not previously use a unique password at 23andMe, presume your data was compromised.
  4. If you have to assume your data was compromised, be hyper-vigilant of anything unusual or strange.
  5. Check to see if your email address associated with 23andme received a DNA file download request that you did not initiate, and if so, notify 23andMe immediately at customercare@23andme.com or 1-800-239-5230.

Other Companies

Other DNA testing companies are taking precautions and reviewing safeguards. Some have or may disable some features as they move through the process. Don’t be angry if a feature you depend on is gone for now.

The situation is changing very rapidly. I don’t know if the changes at the vendors, including 23andMe, will be permanent, and the companies probably don’t yet either.

Right now, overall, patience is the word as this mess sorts itself out – but while being patient, be sure to review your own safeguards and follow safe online practices.

_____________________________________________________________

Follow DNAexplain on Facebook, here.

Share the Love!

You’re always welcome to forward articles or links to friends and share on social media.

If you haven’t already subscribed (it’s free,) you can receive an email whenever I publish by clicking the “follow” button on the main blog page, here.

You Can Help Keep This Blog Free

I receive a small contribution when you click on some of the links to vendors in my articles. This does NOT increase the price you pay but helps me to keep the lights on and this informational blog free for everyone. Please click on the links in the articles or to the vendors below if you are purchasing products or DNA testing.

Thank you so much.

DNA Purchases and Free Uploads

Genealogy Products and Services

My Book

Genealogy Books

Genealogy Research

23andMe User Accounts Exposed – Change Your Password Now

Posted on by
35

Call it what you may – a hacking attack, a breach, loophole, compromise, it doesn’t matter – there’s an issue at 23andMe, allegedly compromising the data of 7 million+ accounts – and you need to take action now.

I’m telling you what you need to do and why, then providing additional information. I’m presenting this weekend and very deadlined on other work as well, so this article is short and not-so-sweet.

  1. Change your password at 23andMe TO A COMPLEX PASSWORD NOT USED ANYPLACE ELSE.
  2. Consider enabling 2-factor authentication at 23andMe.

This issue has been reported to 23andMe by several people. This issue seems to have existed for several weeks, but those details don’t really matter right now.

While on October 3rd, 23andMe initially said that they “conducted an investigation” and “had not identified any unauthorized access” to their system, their press statement today was different, as reported at Wired.

What changed in the past couple of days is that this compromise became more widely known on various sites and servers, making its way into the media.

This detailed user information is for sale on the dark web. Jewish people may have been targeted, but a lot is unknown.

I have not seen these amalgamated breached files myself, but I worked with a security person who has to verify this information. That was today, and when we finished, this had blown up publicly today.

Briefly – What Has Happened?

Hackers have compiled information from multiple data breaches over time from companies across the web. That’s been going on for a long time.

Hackers have been using that information to sign into accounts at 23andMe.

Here’s how that works.

23andMe uses your email as the first step of signing on, then a password. If you use the same password at lots of places, and hackers compile breach information, they will know that the password “Fluffy” is associated with your email address, and they found it six different times in various data breaches.

So, they went to 23andMe and attempted to sign in with your email. Next, they tried “Fluffy” as your password, and voila, they were in – as you. Now the hacker has access to your profile information, not through any negligence at 23andMe, but because of data breaches elsewhere combined with an insecure and non-unique password.

Hackers then have access to DNA Relatives, shared matches, ethnicity, traits, and medical information. Furthermore, they can view the information of your matches who have opted to share their health information with you. Remember, the hacker is now operating as “you.”

Passwords

Many people reuse passwords at different sites because they are easy to remember.

DON’T REUSE PASSWORDS. Ever. Make them unique, hard or impossible to guess, and certainly not Fluffy or any other word that can be associated with you via social media. Also, never, ever answer those social media “fun” questions because you are unnecessarily giving information away publicly. Bad actors aggregate that information too.

You need to take remediation action immediately to secure your account.

Go to Settings under your initials in the upper right-hand corner of your account page.

Then select Password and follow the steps.

Accounts You Manage

This also means that if you manage other people’s DNA kits within your own account, their accounts have been compromised through yours (if your account has been compromised), including any medical information.

Articles

Here are articles published within the past 24 hours for your review. Unfortunately, PC Magazine published a thread from X (formerly Twitter) where someone used a screenshot from my blog (without permission) which is part of how I got dragged into this and why I got notified.

This thread was posted on Twitter two days ago. This data “leak” had been reported before that to 23andMe and may have existed since August.

The dark box is the hacker saying that if 23andMe does not announce a data breach within 24 hours, they will start sharing the user data. I’m not posting the threat here, but you can view it on X (former Twitter.)

23andMe gave their standard canned reply.

Then I inadvertently got dragged into this mess because, next, someone grabbed a screenshot from one of my blog articles from 2019, which exposed my name – then PC magazine published a screenshot of their posting.

In that article, I was writing about a 2019 relationship between 23andMe and FamilySearch, hence the arrow. I believe that the Twitter poster grabbed the image as an example of the 23andMe DNA Relatives user interface, but it was an unfortunate choice. They should have used their own, not scalped mine.

We really have no idea what may be discovered as this situation evolves, but at this point, 23andMe has stated that they are investigating.

The Second Issue

It appears there’s a second issue, too. The person who notified me of the original issue also told me that signing on to your own account, then replacing your profile ID with someone else’s profile ID displays their name and at least some of their information.

I’ve blurred my profile ID in the above string.

They had personally reported this to 23andMe, including emailing the CEO personally, and received the same boilerplate message as reported by others. Here’s a quote:

“Hi [xxx- name redacted] – Following a claim that someone had gained access to and is selling certain 23andMe customer data, we conducted an investigation. We have not identified any unauthorized access to our systems. We will continue to monitor the situation.”

I tried this with my matches’ IDs and could see their information, but of course I should be able to access my matches’ profiles, so I didn’t find this disturbing. I tried this with people I had invited to connect with that I don’t match, and I could see those as well. That too is expected. Although, I must admit that I was rather startled to be able to access it that way.

I tried randomly replacing digits and characters in my own profile ID and that didn’t work. But then again, there’s no way to know if the number I created was actually a valid profile ID.

Then, I signed on to an account of someone whose account I manage completely separately from my account and copied the profile ID of a second account I manage separately from my account. Those two people don’t know each other and are not related.

I could see the identity of the person whose profile ID I copied into the string, replacing the profile ID of the account I was signed into.

I saw the information below.

I’ve blurred the person’s name, initials in the purple circle, and their “about” information. However, notice that their current location is also exposed, along with their full name.

The good news is that I can’t see anything else. However, I shouldn’t be able to see this much.

I don’t think I could have done this:

  • Without first being signed into a valid account AND
  • Without knowing the profile identification, which I don’t think I could have found unless the person gave it to me, or unless it’s in the hacked information, which I understand that it is. However, if the hacked information includes the profile ID, that means the hackers are already into that account, so they don’t need to do this.

To be on the safe side, I’m removing “about” information other than ancestral surnames in my account and the accounts I manage.

I have never been comfortable with my current location being shown to anyone, including matches.

If you want to remove your location information, navigate to the map function under DNA Relatives and make your modification there.

Conclusion

Right now, I’m far more concerned about keeping you safe than 23andMe’s investigation. That’s analogous to figuring out who opened the barn door after half the herd is gone. Yes, it needs to be done and the issue addressed, but their investigation won’t help you right now.

The exposure may NOT be half of their database. It may NOT include you. Please assume it does and protect yourself.

Please change your password and consider implementing two-factor authentication. I recommend removing your location information.

Also, don’t reuse passwords. Here’s a great article about password safety.

I surely hope 23andMe is partnering with legal and security resources and has engaged an expert firm for compromise assessment.

In essence, the hacker was using our DNA information as a lever to attempt to force 23andMe to announce a breach. It’s unclear what their motivation is, but based on reports from multiple people who have seen these files, the threat is credible, as confirmed by 23andMe today. I’m not sure if the hackers really want to sell our data to bad actors on the dark web or already have, or if they want to extort money, essentially ransom, out of 23andMe, or what.

23andMe is a victim here, too, because the leaked information seems to be due to compromised user passwords that did NOT occur on their system. This has generated a lot of speculation about the motivation of the hacker.

Regardless, that doesn’t change the fact that the hacker has a huge amount of data, and it’s out of our control. I don’t know how to or if you will ever know if your data is included. I don’t know how 23andMe would be able to ascertain whose accounts are involved since the accounts were all signed into legitimately using the correct email and password.

While I realize that this situation is at least partly due to customers reusing passwords, that does not justify or rationalize the delay by 23andMe in taking the issue seriously, wasting valuable time, and allowing the hacker to gather more information. Nor does it excuse the second security issue, although that seems to be less serious.

I feel bad for any company targeted like this, while I’m also furious with 23andMe about their arrogance and cavalier attitude, resulting in unnecessary delay. Right now, as a customer, I’m not interested in playing the blame game or debating semantics about which type of compromise this is. It’s bad, regardless.

The hacker has attacked 23andMe AND their customers, you and me, but this could have been any company. The ONLY way to preclude this as a customer in a digital world is to maintain password security and use unique, complex passwords – on every account.

Hopefully, we will know more soon. In the meantime, change your password and lock down your account so that no one else has access.

Please share this article with genealogy organizations or anyone you know who has tested with 23andMe so they can protect themselves.

______________________________________________________________

Sign Up Now – It’s Free!

If you appreciate this article, subscribe to DNAeXplain for free to automatically receive new articles by email weekly.

Here’s the link. Look for the black “follow” button on the right-hand side of your computer screen below the black title bar, enter your e-mail address, click “Follow,” and you’re good to go!

Ancestry’s ThruLines Are a Hot Mess Right Now – But Here Are Some Great Alternatives

Posted on by
38

Right now, ThruLines at Ancestry is one hot mess.

Aside from the inherent frustration, especially over a holiday weekend when many people had planned to work on their genealogy, I’d like to say, “don’t panic.”

I don’t have any inside information about what’s going on at Ancestry, and I’ve attempted to make contact through their support page with no luck. They make talking to a person exceedingly difficult; plus, it’s a holiday weekend, and they are probably inundated.

Regardless, I have an idea of what is happening. Ancestry has been in the midst of recalculating “things,” perhaps in relation to their other changes, which I’ll write about separately in a few days.

In any event, Ancestry SURELY MUST KNOW there’s a significant problem because I imagine thousands of their customers are screaming right about now. Adding another voice won’t be helpful.

Symptoms

  • You may not have ThruLines at all.
  • If you do have ThruLines, don’t trust the information, or more to the point, don’t trust that it’s in any way complete.

I have two tests at Ancestry, both connected to different trees so that my matches and Thrulines are calculated separately for each test.

Test One

My first Ancestry test is connected to my primary tree. I’ve been amassing Thrulines cousins ever since the feature was released. I have hundreds of cousin matches descended from some of my more prolific ancestors.

Additionally, my sister’s grandchildren have tested, as have other close relatives who have connected their tests to their trees.

Today, those people are still showing on my match list, but are NOT showing as matches in ThruLines. None of them. Most of my ThruLines ancestors are showing zero matches, and the rest are only showing very few. Ancestors who had hundreds before now have 2, for example.

Here’s an example with my cousin, Erik.

My grandfather, William George Estes, shown in Erik’s tree, above, is his great-grandfather. Erik is my half first cousin, once removed, and we share 417 cM over 16 segments.

Yet, looking at my ThruLine for William George Estes, neither he nor my other cousins are shown as matches. Same for William George’s parents, and so forth.

ThruLines is VERY ill right now.

Test Two

My second DNA test at Ancestry is even worse. There are no ThruLines calculated, even though my DNA is tree-attached, and I had ThruLines previously.

I see this message now, and I can’t even begin to tell you how irritating this is – in part because it suggests the problem is my fault. It’s clearly not. My tree hasn’t changed one bit. I’m not alone, either. I’ve seen other people posting this same message.

And yes, if you’re thinking that there is absolutely no excuse for this – you’re right.

However, outrage isn’t good for us and won’t help – so let’s all do something else fun and productive instead.

Productive Genealogy Plans

Here are some productive suggestions.

At MyHeritage:

At FamilyTreeDNA:

  • Build your haplogroup pedigree chart by locating people through different companies descended from each ancestor in your tree through the appropriate line of descent, and see if they have or will take a Y-DNA or mtDNA test.
  • Tests are on sale right now, and there’s no subscription required at FamilyTreeDNA for anything.
  • Check Y-DNA and mtDNA tests to see if there are new matches and if you share a common ancestor.

At 23andMe:

  • Check for new matches and triangulation.
  • Check to see if 23andMe has added any of your new matches to your genetic tree.

Remember, the parental sides are typically accurate, but the exact placement may not be, and 23andMe deals poorly with half-relationships. It’s certainly still worth checking though, because 23andMe does a lot of heavy lifting for you.

DNAPainter

For me, the most productive thing to do this weekend would be to copy the segment information from new matches with whom I can identify common ancestors at FamilyTreeDNA, MyHeritage and 23andMe – the vendors who provide segment data – and paint those segments to DNAPainter.

Not only does DNAPainter allow me to consolidate my match data in one place, DNAPainter provides the ability for me to confirm ancestors through triangulation, and to assign unknown matches to ancestors as well.

As you can see, I’ve successfully assigned about 90% of my segments to an ancestor, meaning I’ve confirmed descent from that ancestor based on my autosomal matches’ descent from that same ancestor – preferably through another child. Will new matches propel me to 91%? I hope so.

What percentage can you or have you been able to assign?

If you need help getting started, or ideas, I’ve written about DNAPainter several times and provided a compiled resource library of those articles, here.

Have fun!!!

_____________________________________________________________

Follow DNAexplain on Facebook, here.

Share the Love!

You’re always welcome to forward articles or links to friends and share on social media.

If you haven’t already subscribed (it’s free,) you can receive an email whenever I publish by clicking the “follow” button on the main blog page, here.

You Can Help Keep This Blog Free

I receive a small contribution when you click on some of the links to vendors in my articles. This does NOT increase the price you pay but helps me to keep the lights on and this informational blog free for everyone. Please click on the links in the articles or to the vendors below if you are purchasing products or DNA testing.

Thank you so much.

DNA Purchases and Free Uploads

Genealogy Products and Services

My Book

Genealogy Books

Genealogy Research

23andMe and GlaxoSmithKline Partnership Ends, Sparking Additional Layoffs

Posted on by
13

23andMe has been slimming down. In April, they announced they were cutting about 75 jobs in their therapeutics division, equating to about 9% of their workforce, and now they have cut another 71 employees in response to the end of the five-year GSK partnership.

GenomeWeb reported the earlier and most recent 23andMe layoffs, along with a 6% revenue dip, here. 23andMe is a publicly held company and reported a net loss of $104.6 million.

In 2018, 23andMe partnered with GSK, GlaxoSmithKline, a British drug company, to jointly develop drugs based on the genomic profiles of their customers who choose to participate in this type of research. You may have noticed that 23andMe asks a wide variety of questions that genealogy testing companies typically don’t, and they also report on health and traits.

At the onset of the partnership, GSK made a $300 million equity investment in 23andMe. If you need to cure insomnia, you can read the SEC filing, here.

The original partnership was to last four years and could be extended for an additional 5th year, which it was, landing another 50 million dollars in the 23andMe coffers.

According to the press release by 23andMe and this 2020 blog article, the partnership has been successful, adding more than 40 genetically validated drug discovery programs to the GSK portfolio, making me wonder why the partnership was not extended.

Customers

The 23andMe page for medical professionals states that they have more than 12 million customers worldwide.

23and Me has stated several times that about 80% of their customers opt-in to research, which means that their de-identified DNA sequences are made available to both 23andMe and their selected partners for research purposes.

Accordingly, about 8 million people have opted-in to research.

If you’re doing the math, that means that:

  • 23andMe received $29.17 for each of their 12 million customers

Viewed another way:

  • 23andMe received $43.75 for each of their 8 million customers who are opted-in for research

Attempting to Increase Revenues

In the past several months, 23andMe has attempted to staunch the corporate blood flow by:

Neither of these moves have been well-received by genealogists.

Purchase Price

23andMe sells two types of tests. One is for both health and ancestry, and the second is for ancestry, aka genealogy, only.

  • The 23andMe Health and Ancestry test is currently priced at $229. The yearly membership costs an additional $69, for a total of $298, but the membership is currently free during the first year. That’s a lot for an autosomal test that only buys you up to 5000 matches.
  • The 23andMe ancestry-only test is $119, but comes with restrictions, including the 1500 match limit.

For comparison purposes, this article shows how many matches I have at each vendor.

If you want more than 1500 matches, you MUST PURCHASE the Health and Ancestry test, not the lower-cost genealogy-only test, plus the additional membership.

This is a very difficult pill to swallow (pardon the pun.) None of the other DNA testing companies limit your matches or charge for matching, and their prices right now for their autosomal tests are as follows:

Subscription aka Membership

In order to entice customers into purchasing subscriptions, called memberships, 23andMe allows up to 5000 matches instead of 1500. 23andMe has also limited additional features, taking them away from their original customers and putting them behind the subscription paywall.

In October 2020, when they implemented subscriptions, called memberships, along with these changes, they reduced their customers’ original match limit from 2000 to 1500. Of course, to receive more matches, you could purchase a new test and subscribe. No thank you.

In another attempt to throttle services to earlier customers, there were initially no ethnicity updates for people in October of 2020 who had tested on V2, V3 or V4 chips, although following public outcry, they reversed that position for at least the V3 and V4 customers. No other DNA testing company excludes customers from ethnicity updates. 

One cannot perform other functions, such as sort or filter by haplogroup on their site, unless you purchase the Health and Ancestry test, plus a membership. You can, however, download your matches and sort/filter that way..

What’s Next for 23andMe?

23andMe says they are now actively pursuing new big pharma partners.

I hope they can find their way forward. While I don’t often find relevant matches at 23andMe anymore, and I have an issue with their subscription policy, especially removing features from existing customers, they do have a pool of 12 million-ish people. These matches certainly help many people, especially because their health customers probably won’t have tested elsewhere.

Having said that, I can’t help but wonder how many of those 12 million are the same person multiple times because they’ve had to purchase multiple tests. I’ve purchased three for myself over the years, and I’m not purchasing a fourth – but I digress.

  • 23andMe is still a good site for matching, especially for adoptees or people seeking unknown family members. You can also see how your matches match each other. You just never know where that critical match is going to pop up.
  • 23andMe provides painted ethnicity chromosome segments, along with FamilyTreeDNA. In my opinion, they are the top two vendors for ethnicity accuracy.
  • 23andMe and FamilyTreeDNA both report X-DNA matching, which can be very useful.
  • 23andMe is still the only vendor to construct a genetic tree – and yes – I know it’s not always completely accurate. Still, their tree creation is innovative and automated – based on how you match people and how they match each other. For adoptees and people seeking parents or grandparents, it’s essential because they start with nothing.
  • 23andMe doesn’t allow customers to upload or create a family tree, so you can’t view the family tree of your matches to find a common ancestor. You can include a link to your online family tree in your Enhanced Profile under Settings, but many people never see this, or aren’t genealogists.

Unfortunately, 23andMe is not focused on genealogy – at all. Their focus has always been medicine and health. From their perspective, genealogists are candidates to opt-in for genetic research, but that doesn’t mean genealogists can’t still benefit – even if we don’t opt-in, don’t purchase the more expensive $229 Health and Ancestry test, and don’t purchase their membership.

If you’re interested in more recent relatives, 23andMe is great because the 1500 match limit won’t impact you at all. Closer relatives will cluster at the top of your match list.

If you’re looking for matches that descend from more distant ancestors, you may find it worthwhile to purchase the more expensive test and the membership, at least for one year.

Filtering/Sorting Restriction Workaround 

While there’s no way around the 1500 or 5000 match limit, except that 23andMe won’t roll someone off of your match list if you’ve communicated with them, or tried to, there is a workaround for the restrictive filtering.

I check my matches periodically, sorting by the newest matched relatives. I also download my match list occasionally. I find it easier to review the information in spreadsheet format because I can search for surnames, locations, haplogroups and other information much more easily than online, especially given the restrictive filters.

However, when you download your match list, that information is downloaded as well.

Be sure to record notes on each match at 23andMe when you discover relevant information by clicking on the match and scrolling to the very bottom of the page. Your notes at 23andMe are downloaded onto the spreadsheet along with the rest of their information.

The instructions for downloading your match list, which is NOT the same as downloading your DNA file, are contained in this article. Give it a try!

_____________________________________________________________

Follow DNAexplain on Facebook, here.

Share the Love!

You’re always welcome to forward articles or links to friends and share on social media.

If you haven’t already subscribed (it’s free,) you can receive an email whenever I publish by clicking the “follow” button on the main blog page, here.

You Can Help Keep This Blog Free

I receive a small contribution when you click on some of the links to vendors in my articles. This does NOT increase the price you pay but helps me to keep the lights on and this informational blog free for everyone. Please click on the links in the articles or to the vendors below if you are purchasing products or DNA testing.

Thank you so much.

DNA Purchases and Free Uploads

Genealogy Products and Services

My Book

Genealogy Books

Genealogy Research

Paint LivingDNA Chromosome Segments to DNAPainter

Posted on by
9

LivingDNA entered the genetic genealogy landscape as a vendor in September of 2016, A British company, they were and remain focused on British Isles testers and ethnicity based on the POBI, People of the British Isles Study.

Initially, they provided only ethnicity results and high-level haplogroups, but added family matching relatively recently.

If you have not tested or uploaded to LivingDNA, you may want to read about the company and leadership, here, before doing so.

Family Matching

Please note that their family matching is imperfect, so exercise a great deal of caution.

This states that my mother’s kit, which I uploaded and own, has no matches.

My mother reportedly has no matches, including NOT TO ME. If I were to make a family inference from this, I would conclude that my mother is not my mother. That is very clearly not the case. For obvious reasons, it could be even more damaging within a family unit for a DNA company to report no matches between a father and child.

However, a second upload file from the same testing company for my mother at LivingDNA DOES reflect me as a match.

I have about 650 matches at LivingDNA, but I only share 141 matches with my mother. The rest would either be to my father’s side of the family, or identical by chance (IBC.)

Chromosome Browser

LivingDNA has been promising a chromosome browser “soon” for several years now, since at least the fall of 2017 when I spoke to them at Genetic Genealogy Ireland in Dublin. That long-awaited day has arrived. You can view your matches in a chromosome browser and paint your segments with your matches at DNAPainter to obtain additional information.

To briefly review, the purpose of a chromosome browser is to identify specific segments of your DNA that you share in common with your matches. These common segments will be associated with your common ancestors, presuming the match is identical by descent (IBD) and not identical by chance (IBC.) If you’re unfamiliar, you can read about those concepts in the article Concepts – Identical by…Descent, State, Population and Chance.

Assigning Common Segments

Of course, assigning common DNA segments with your matches to specific ancestors implies one of three things.

Either:

  1. A tree where you can identify a common ancestor or ancestral line with your match
  2. Shared matches with a family member you know
  3. Communications with your match to identify a shared ancestor

LivingDNA does not provide a tree function, so you cannot view other testers’ family trees. Neither do they provide a field for a link to an existing tree someplace else, so users are handicapped.

LivingDNA does provide a message facility, so you can message your matches and ask about their genealogy and where they may have a tree you can view.

Unless you recognize a match or your match provides you with a tree to view, you may only be able to identify common ancestors through previously identified shared matches.

Shared Matches

Your best bet is identifying a cousin or other family member at LivingDNA. I only have one match that I can identify, and that’s my mother.

I can click on our 141 shared matches in common to view that list.

Unfortunately, my closest shared match with my mother is 36 cM. Matches are not listed in segment size order. LivingDNA is not popular outside of the British Isles, but you never know where a useful match will pop up.

My closest match, other than my mother, is Christopher with whom I share 101 cM across five segments.

Christopher does not share a match with my mother, and 101 cM is too large to be IBC, so my conclusion would be that Christopher and I share ancestors on my father’s side.

I viewed the 17 shared matches Christopher and I have in common, but I don’t recognize anyone from the other testing sites.

I could, of course, message Christopher and ask about his genealogy.

However, there’s another option too. Because I’ve been painting my known matches at DNAPainter, I can now paint my match with Christopher, which might identify our common ancestor or at least provide a significant hint.

Chromosome Browser

My personal goal is to identify my DNA segments that descend from each ancestor, and to associate 100% of my DNA with an ancestor. Without knowing who our common ancestor is, painting matching segments is not terribly useful.

However, let’s say that I know who Christopher is, or that I recognize some of our 17 shared matches allowing me to identify our common ancestor(s).

By clicking on the right arrow, you’ll be able to view a selection menu.

By clicking on the blue Shared DNA Beta link, I can view my match with Christopher either on a chromosome browser, or in a table.

My common segments with Christopher are painted on my chromosomes, above.

Click on “table view” at the top to view only the segment data where Christopher matches me on chromosomes 1-22.

Painting at DNAPainter

Click on the “Copy segment data” tab in the upper right-hand corner to copy the segment data to paint at DNAPainter.

I have written several articles about using DNAPainter, which you can reference, here.

Open DNAPainter.

I selected “Paint a New Match” at DNAPainter, then pasted the copied segment information from LivingDNA.

Click on “Save Match Now’ in the lower right-hand corner.

You will need to select either the maternal or paternal side, or unknown.

We know that Christopher matches me on my father’s side because the match is large and we do not share my mother as a match.

Since I haven’t yet identified our common ancestor, I selected teal blue to differentiate the LivingDNA match.

As it turns out, Christopher at LivingDNA matches the same segments as another man named Christopher who tested at 23andMe. It’s the same person.

I identified my common ancestor with Christopher at 23andMe as Lazarus Estes and Elizabeth Vannoy, my great-grandparents.

At DNAPainter, I’ve assigned segments of other descendants of this couple the color grey. You can easily see that the same segment on chromosome 14 is assigned to several other descendants of Lazarus Estes and Elizabeth Vannoy.

Therefore, the additional 17 shared matches at LivingDNA with Christopher, assuming they are valid IBD matches, would descend from the same genetic line, if not the same couple. In other words, some of that DNA might have descended to me from Lazarus or Elizabeth, but might have descended to Christopher or others through the parents of either Lazarus or Elizabeth, or another common upstream ancestor.

Every segment has its own unique ancestral history.

Thanks to DNAPainter

LivingDNA has joined the group of vendors who provide a complimentary chromosome browser and segment information for their customers. Other DNA testing vendors who do as well include 23andMe, FamilyTreeDNA and MyHeritage, plus third-party GEDmatch.

A big thank you to DNAPainter for a comprehensive tool to track segments and assign them to ancestors in one easy-to-use all-inclusive tool.

_____________________________________________________________

Follow DNAexplain on Facebook, here.

Share the Love!

You’re always welcome to forward articles or links to friends and share on social media.

If you haven’t already subscribed (it’s free,) you can receive an email whenever I publish by clicking the “follow” button on the main blog page, here.

You Can Help Keep This Blog Free

I receive a small contribution when you click on some of the links to vendors in my articles. This does NOT increase the price you pay but helps me to keep the lights on and this informational blog free for everyone. Please click on the links in the articles or to the vendors below if you are purchasing products or DNA testing.

Thank you so much.

DNA Purchases and Free Uploads

Genealogy Products and Services

My Book

Genealogy Books

Genealogy Research

Which DNA Test Should I Buy? And Why?

Posted on by
18

Which DNA test should I buy, and why?

I receive questions like this often. As a reminder, I don’t take private clients anymore, which means I don’t provide this type of individual consulting or advice. However, I’m doing the next best thing! In this article, I’m sharing the step-by-step process that I utilize to evaluate these questions so you can use the process too.

It’s important to know what questions to ask and how to evaluate each situation to arrive at the best answer for each person.

Here’s the question I received from someone I’ll call John. I’ve modified the wording slightly and changed the names for privacy.

I’m a male, and my mother was born in Charleston, SC. My maternal grandmother’s maiden name was Jones and a paternal surname was Davis. The family was supposed to have been Black, Dutch, Pennsylvania Dutch, and Scots-Irish…only once was I told I was 3/16 Indian, with Davis being 3/4 and Jones being full Indian.

Do I have enough reasonable information to buy a test, and which one?

Please note that it’s common for questions to arrive without all the information you need to provide a sound answer – so it’s up to you to ask those questions and obtain clarification.

Multiple Questions

There are actually multiple questions here, so let me parse this a bit.

  1. John never mentioned what his testing goal was.
  2. He also never exactly said how the paternal line of Davis was connected, so I’ve made an assumption. For educational purposes, it doesn’t matter because we’re going to walk through the evaluation process, which is the same regardless.
  3. John did not include a tree or a link to a tree, so I created a rudimentary tree to sort through this. I need the visuals and normally just sketch it out on paper quickly.
  4. Does John have enough information to purchase a test?
  5. If so, which test?

There is no “one size fits all” answer, so let’s discuss these one by one.

Easy Answers First

The answer to #4 is easy.

Anyone with any amount of information can purchase a DNA test. Adoptees do it all the time, and they have no prior information.

So, yes, John can purchase a test.

The more difficult question is which test, because that answer depends on John’s goals and whether he’s just looking for some quick information or really wants to delve into genealogy and learn. Neither approach is wrong.

Many people think they want a quick answer –  and then quickly figure out that they really want to know much more about their ancestors.

I wrote an article titled DNA Results – First Glances at Ethnicity and Matching for new testers, here.

Goals

Based on what John said, I’m going to presume his goals are probably:

  • To prove or disprove the family oral history of Black, Dutch, Pennsylvania Dutch (which is actually German,) Scots-Irish, and potentially Native American.
  • John didn’t mention actual genealogy, which would include DNA matches and trees, so we will count that as something John is interested in secondarily. However, he may need genealogy records to reach his primary goal.

If you’re thinking, “The process of answering this seemingly easy question is more complex than I thought,” you’d be right.

Ethnicity in General

It sounds like John is interested in ethnicity testing. Lots of people think that “the answer” will be found there – and sometimes they are right. Often not so much. It depends.

The great news is that John really doesn’t need any information at all to take an autosomal DNA test, and it doesn’t matter if the test-taker is male or female.

To calculate each tester’s ethnicity, every testing company compiles their own reference populations, and John will receive different results at each of the major companies. Each company updates their ethnicity results from time to time as well, and they will change.

Additionally, each company provides different tools for their customers.

The ethnicity results at different companies generally won’t match each other exactly, and sometimes the populations look quite different.

Normally, DNA from a specific ancestor can be found for at least 5 or 6 generations. Of course, that means their DNA, along with the DNA from all of your other ancestors is essentially combined in a communal genetic “pot” of your chromosomes, and the DNA testing company needs to sort it out and analyze your DNA for ethnicity.

DNA descended from ancestors, and their populations, further back in people’s trees may not be discerned at all using autosomal DNA tests.

A much more specific “ethnicity” can be obtained for both the Y-DNA line, which is a direct patrilineal line for men (blue arrow,) and the mitochondrial DNA line (pink arrows,) which is a direct matrilineal line for everyone, using those specific tests.

We will discuss both of those tests after we talk about the autosomal tests available from the four major genealogy DNA testing companies. All of these tools can and should be used together.

Let’s Start with Native American

Let’s evaluate the information that John provided.

John was told that he “was 3/16 Indian, with Davis being 3/4 and Jones being full Indian.”

We need to evaluate this part of his question slightly differently.

I discussed this in the article, Ancestral DNA Percentages – How Much of Them is in You?

First, we need to convert generations to 16ths.

You have two ancestors in your parent’s generation, four in your grandparents, and so forth. You have 16 great-great-grandparents. So, if John was 3/16th Native, then three of his great-great-grandparents would have been fully Native, or an equivalent percentage. In other words, six ancestors in that generation could have been half-Native. Based on what John said, they would have come from his mother’s side of the tree. John is fortunate to have that much information to work with.

He told us enough about his tree that we can evaluate the statement that he might be 3/16ths Native.

Here’s the tree I quickly assembled in a spreadsheet based on John’s information.

His father, at left, is not part of the equation based on the information John provided.

On his mother’s side, John said that Grandfather Davis is supposed to be three-quarters Native, which translates to 12/16ths. Please note that it would be extremely beneficial to find a Y-DNA tester from his Davis line, like one of his mother’s brothers, for example.

John said that his Grandmother Jones is supposed to be 100% Native, so 16/16ths.

Added together, those sum to 28/32, which reduces down to 14/16th or 7/8th for John’s mother.

John would have received half of his autosomal DNA from his mother and half from his non-Native father. That means that if John’s father is 100% non-Native, John would be half of 14/16ths or 7/16ths, so just shy of half Native.

Of course, we know that we don’t always receive exactly 50% of each of our ancestors’ DNA (except for our parents,) but we would expect to see something in the ballpark of 40-45% Native for John if his grandmother was 100% Native and his grandfather was 75%.

Using simple logic here, for John’s grandmother to be 100% Native, she would almost assuredly have been a registered tribal member, and the same if his grandfather was 75% Native. I would think that information would be readily available and well-known to the family – so I doubt that this percentage is accurate. It would be easy to check, though, on various census records during their lifetimes where they would likely have been recorded as “Indian.” They might have been in the special “Indian Census” taken and might be living on a reservation.

It should also be relatively easy to find their parents since all family members were listed every ten years in the US beginning with the 1850 census.

The simple answer is that if John’s grandparents had as much Native as reported, he would be more than 3/16th – so both of these factoids cannot simultaneously be accurate. But that does NOT mean neither is accurate.

John could be 7/8th or 40ish%, 3/16th or 18ish%, or some other percentage. Sometimes, where there is smoke, there is fire. And that seems to be the quandary John is seeking to resolve.

Would  Ethnicity/Population Tests Show This Much Native?

Any of the four major testing companies would show Native for someone whose percentage would be in the 40% or 18% ballpark.

The easiest ethnicities to tell apart from one another are continental-level populations. John also stated that he thinks he may also have Black ancestry, plus Dutch, Pennsylvania Dutch (German), and Scots-Irish. It’s certainly possible to verify that using genealogy, but what can DNA testing alone tell us?

How far back can we expect to find ethnicities descending from particular ancestors?

In this table, you can see at each generation how many ancestors you have in that generation, plus the percentage of DNA, on average, you would inherit from each ancestor.

All of the major DNA testing companies can potentially pick up small trace percentages, but they don’t always. Sometimes one company does, and another doesn’t. So, if John has one sixth-generation Native American ancestor, he would carry about 1.56% Native DNA, if any.

  • Sometimes a specific ethnicity is not found because, thanks to random recombination, you didn’t inherit any of that DNA from those ancestors. This is why testing your parents, grandparents, aunts, uncles, and siblings can be very important. They share your same ancestors and may have inherited DNA that you didn’t that’s very relevant to your search.
  • Sometimes it’s not found because the reference populations and algorithms at that testing company aren’t able to detect that population or identify it accurately, especially at trace levels. Every DNA testing company establishes their own reference populations and writes internal, proprietary ethnicity analysis algorithms.
  • Sometimes it’s not found because your ancestor wasn’t Native or from that specific population.
  • Sometimes it’s there, but your population is called something you don’t expect.

For example, you may find Scandinavian when your ancestor was from England or Ireland. The Vikings raided the British Isles, so while some small amount of Scandinavian is not what you expect, that doesn’t mean it‘s wrong. However, if all of your family is from England, it’s not reasonable to have entirely Scandinavian ethnicity results.

It’s also less likely as each generation passes by that the information about their origins gets handed down accurately to following generations. Most non-genealogists don’t know the names of their great-grandparents, let alone where their ancestors were from.

Using a 25-year average generation length, by the 4th generation, shown in the chart above, you have 16 ancestors who lived approximately 100 years before your parents were born, so someplace in the mid-1800s. It’s unlikely for oral history from that time to survive intact. It’s even less likely from a century years earlier, where in the 7th generation, you have 128 total ancestors.

The best way to validate the accuracy of your ethnicity estimates is by researching your genealogy. Of course, you need to take an ethnicity test, or two, in order to have results to validate.

Ethnicity has a lot more to offer than just percentages.

Best Autosomal Tests for Native Ethnicity

Based on my experience with people who have confirmed Native ancestry, the two best tests to detect Native American ethnicity, especially in smaller percentages, are both FamilyTreeDNA and 23andMe.

Click images to enlarge

In addition to percentages, both 23andMe and FamilyTreeDNA provide chromosome painting for ethnicity, along with segment information in download files. In other words, they literally paint your ethnicity results on your chromosomes.

They then provide you with a file with the “addresses” of those ethnicities on your chromosomes, which means you can figure out which ancestors contributed those ethnicity segments.

The person in the example above, a tester at FamilyTreeDNA, is highly admixed with ancestors from European regions, African regions and Native people from South America.

Trace amounts of Native American with a majority of European heritage would appear more like this.

You can use this information to paint your chromosome segments at DNAPainter, along with your matching segments to other testers where you can identify your common ancestors. This is why providing trees is critically important – DNA plus ancestor identification with our matches is how we confirm our ancestry.

This combination allows you to identify which Native (or another ethnicity) segments descended from which ancestors. I was able to determine which ancestor provided that pink Native American segment on chromosome 1 on my mother’s side.

I’ve provided instructions for painting ethnicity segments to identify their origins in specific ancestors, here.

Autosomal and Genealogy

You may have noticed that we’ve now drifted into the genealogy realm of autosomal DNA testing. Ethnicity is nice, but if you want to know who those segments came from, you’ll need:

  • Autosomal test matching to other people
  • To identify your common ancestor with as many matches as you can
  • To match at a company who provides you with segment information for each match
  • To work with DNAPainter, which is very easy

The great news is that you can do all of that using the autosomal tests you took for ethnicity, except at Ancestry who does not provide segment information.

Best Autosomal Test for Matching Other Testers

The best autosomal test for matching may be different for everyone. Let’s look at some of the differentiators and considerations.

If you’re basing a testing recommendation solely on database size, which will probably correlate to more matches, then the DNA testing vendors fall into this order:

If you’re basing that recommendation on the BEST, generally meaning the closest matches for you, there’s no way of knowing ahead of time. At each of the four DNA testing companies, I have very good matches who have not tested elsewhere. If I weren’t in all four databases, I would have missed many valuable matches.

If you’re basing that recommendation on which vendor began testing earliest, meaning they have many tests from people who are now deceased, so you won’t find their autosomal tests in other databases that don’t accept uploads, the recommended testing company order would be:

If you’re basing that recommendation on matches to people who live in other countries, the order would be:

Ancestry and 23andMe are very distant third/fourth because they did not sell widely outside the US initially and still don’t sell in as many countries as the others, meaning their testers’ geography is more limited. However, Ancestry is also prevalent in the UK.

If you’re basing that recommendation on segment information and advanced tools that allow you to triangulate and confirm your genetic link to specific ancestors, the order would be:

Ancestry does NOT provide any segment information.

If you’re basing that recommendation on unique tools provided by each vendor, every vendor has something very beneficial that the others don’t.

In other words, there’s really no clear-cut answer for which single autosomal DNA test to order. The real answer is to be sure you’re fishing in all the ponds. The fish are not the same. Unique people test at each of those companies daily who will never be found in the other databases.

Test at or upload your DNA to all four DNA testing companies, plus GEDmatch. Step-by-step instructions for downloading your raw data file and uploading it to the DNA testing companies who accept uploads can be found, here.

Test or Upload

Not all testing companies accept uploads of raw autosomal DNA data files from other companies. The good news is that some do, and it’s free to upload and receive matches.

Two major DNA testing companies DO NOT accept uploads from other companies. In other words, you have to test at that company:

Two testing companies DO accept uploads from the other three companies. Uploads and matching are free, and advanced features can be unlocked very cost effectively.

  • FamilyTreeDNA – free matching and $19 unlock for advanced features
  • MyHeritage – free matching and $29 unlock.for advanced features

I recommend testing at both 23andMe and Ancestry and uploading one of those files to both FamilyTreeDNA and MyHeritage, then purchasing the respective unlocks.

GEDmatch

GEDmatch is a third-party matching site, not a DNA testing company. Consider uploading to GEDmatch because you may find matches from Ancestry who have uploaded to GEDmatch, giving you access to matching segment information.

Other Types of DNA

John provided additional information that may prove to be VERY useful. Both Y-DNA and mitochondrial DNA can be tested as well and may prove to be more useful than autosomal to positively identify the origins of those two specific lines.

Let’s assume that John takes an autosomal test and discovers that indeed, the 3/16th Native estimate was close. 3/16th equates to about 18% Native which would mean that three of his 16 great-great-grandparents were Native.

John told us that his Grandmother Jones was supposed to be 100% Native.

At the great-great-grandparent level, John has 16 ancestors, so eight on his mother’s side, four from maternal grandmother Jones and four from his maternal grandfather Davis.

John carries the mitochondrial DNA of his mother (red boxes and arrows,) and her mother, through a direct line of females back in time. John also carries the Y-DNA of his father (dark blue box, at left above, and blue arrows below.)

Unlike autosomal DNA which is admixed in every generation, mitochondrial DNA (red arrows) is inherited from that direct matrilineal line ONLY and never combines with the DNA of the father. Mothers give their mitochondrial DNA to both sexes of their children, but men never contribute their mitochondrial DNA to offspring. Everyone has their mother’s mitochondrial DNA.

Because it never recombines with DNA from the father, so is never “watered down,” we can “see” much further back in time, even though we can’t yet identify those ancestors.

However, more importantly, in this situation, John can test his own mitochondrial DNA that he inherited from his mother, who inherited it from her mother, to view her direct matrilineal line.

John’s mitochondrial DNA haplogroup that will be assigned during testing tells us unquestionably whether or not his direct matrilineal ancestor was Native on her mother’s line, or not. If not, it may well tell us where that specific line originated.

You can view the countries around the world where Y-DNA haplogroups are found, here, and mitochondrial haplogroups, here.

If John’s mitochondrial DNA haplogroup is Native, that confirms that one specific line is Native. If he can find other testers in his various lines to test either their Y-DNA or mitochondrial DNA, John can determine if other ancestors were Native too. If not, those tests will reveal the origins of that line, separate from the rest of his genealogical lines.

Although John didn’t mention his father’s line, if he takes a Y-DNA test, especially at the Big Y-700 level, that will also reveal the origins of his direct paternal line. Y-DNA doesn’t combine with the other parent’s DNA either, so it reaches far back in time too.

Y-DNA and mitochondrial DNA tests are laser-focused on one line each, and only one line. You don’t have to try to sort it out of the ethnicity “pot,” wondering which ancestor was or was not Native.

My Recommendation

When putting together a testing strategy, I recommend taking advantage of free uploads and inexpensive unlocks when possible.

  • To confirm Native American ancestry via ethnicity testing, I recommend testing at 23andMe and uploading to FamilyTreeDNA, then purchasing the $19 unlock. The free upload and $19 unlock are less expensive than testing there directly.
  • For matching, I recommend testing at Ancestry and uploading to MyHeritage, then unlocking the MyHeritage advanced features for $29, which is less expensive than retesting. Ancestry does not provide segment information, but MyHeritage (and the others) do.

At this point, John will have taken two DNA tests, but is now in all four databases, plus GEDmatch if he uploads there.

  • For genealogy research on John’s lines to determine whether or not his mother’s lines were Native, I recommend an Ancestry and a MyHeritage records subscription, plus using WikiTree, which is free.
  • To determine if John’s mother’s direct matrilineal female line was Native, I recommend that John order the mitochondrial DNA test at FamilyTreeDNA.
  • When ordering multiple tests, or uploading at FamilyTreeDNA, be sure to upload/order all of one person’s tests on the same DNA kit so that those results can be used in combination with each other.

Both males and females can take autosomal and mitochondrial DNA tests.

  • To discover what he doesn’t know about his direct paternal, meaning John’s surname line – I recommend the Big Y-700 test at FamilyTreeDNA.

Only males can take a Y-DNA test, so women would need to ask their father, brother, or paternal uncle, for example, to test their direct paternal line.

  • If John can find a male Davis from his mother’s line, I recommend that he purchase the Big Y-700 test at FamilyTreeDNA for that person, or check to see if someone from his Davis line may have already tested by viewing the Davis DNA Project. Like with mitochondrial DNA, the Y-DNA haplogroup will tell John the origins of his direct Davis male ancestor – plus matching of course. He will be able to determine if they were Native, and if not, discover the origins of the Davis line.
  • For assigning segments to ancestors and triangulating to confirm descent from a common ancestor, I recommend 23andMe, MyHeritage, FamilyTreeDNA and GEDmatch, paired with DNAPainter as a tool.

Shopping and Research List

Here are the tests and links recommended above:

More Than He Asked

I realize this answer is way more than John expected or even knew to ask. That’s because there is often no “one” or “one best” answer. There are many ways to approach the question after the goal is defined, and the first “answer” received may be a bit out of context.

For example, let’s say John has 2% Native ancestry and took a test at a vendor who didn’t detect it. John would believe he had none. But a different vendor might find that 2%. If it’s on his mother’s direct matrilineal line, mitochondrial DNA testing will confirm, or refute Native, beyond any doubt, regardless of autosomal ethnicity results – but only for that specific ancestral line.

Autosomal DNA can suggest Native across all your DNA, but Y-DNA and mitochondrial DNA confirm it for each individual ancestor.

Even when autosomal testing does NOT show Native American, or African, for example, it’s certainly possible that it’s just too far back in time or has not been passed down during random recombination, but either Y-DNA or mitochondrial DNA will unquestionably confirm (or refute) the ancestry in question if the right person is tested.

This is exactly why I attempt to find a cousin who descends appropriately from every ancestor and provide testing scholarships. It’s important to obtain Y-DNA and mitochondrial DNA information for each ancestor.

Which Test Should I Order?

What steps will help you decide which test or tests to take?

  1. Define your testing goal.
  2. Determine if your Y-DNA or mitochondrial DNA will help answer the question.
  3. Determine if you need to find ancestors another generation or two back in time to get the most benefit from DNA testing. In our example, if John discovered that both of his grandparents were enrolled tribal members, that’s huge, and the tribe might have additional information about his family.
  4. Subscribe to Ancestry and MyHeritage records collections as appropriate to perform genealogical research. Additional information not only provides context for your family, it also provides you with the ability to confirm or better understand your ethnicity results.
  5. Extend your tree so that you can obtain the best results from the three vendors who support trees; Ancestry, FamilyTreeDNA, and MyHeritage. All three use trees combined with DNA tests to provide you with additional information.
  6. Order 23andMe and Ancestry autosomal DNA tests.
  7. Either test at or upload one of those tests to MyHeritage, FamilyTreeDNA, and GEDmatch.
  8. If a male, order the Big Y-700 DNA test. Or, find a male from your ancestral line who has taken or will take that test. I always offer a testing scholarship and, of course, share the exciting results!
  9. Order a mitochondrial DNA test for yourself and for appropriately descended family members to represent other ancestors. Remember that your father (and his siblings) all carry your paternal grandmother’s mitochondrial DNA. That’s often a good place to start after testing your own DNA.
  10. If your parents or grandparents are alive, or aunts and uncles, test their autosomal DNA too. They are (at least) one generation closer to your ancestors than you are and will carry more of your ancestors’ DNA.
  11. Your siblings will carry some of your ancestors’ DNA that you do not, so test them too if both of your parents aren’t available for testing.

Enjoy!!!

_____________________________________________________________

Follow DNAexplain on Facebook, here.

Share the Love!

You’re always welcome to forward articles or links to friends and share on social media.

If you haven’t already subscribed (it’s free,) you can receive an email whenever I publish by clicking the “follow” button on the main blog page, here.

You Can Help Keep This Blog Free

I receive a small contribution when you click on some of the links to vendors in my articles. This does NOT increase the price you pay but helps me to keep the lights on and this informational blog free for everyone. Please click on the links in the articles or to the vendors below if you are purchasing products or DNA testing.

Thank you so much.

DNA Purchases and Free Uploads

Genealogy Products and Services

My Book

Genealogy Books

Genealogy Research