Okay, I’m not happy about it, but it’s happened: 23andMe has removed the chromosome browser from their features after the recent “credential stuffing” attack. The chromosome browser is the tool that lets us see which segments we share with our DNA relatives. MyHeritage has done the same, although they haven’t publicly stated why.
Briefly, a cybercriminal was able to access some accounts whose owners “recycled” their login credentials, meaning those owners used the same email address and password combination at other sites on the web, where they were compromised.
Even though 23andMe’s own security was not breached, a significant percentage of their customers were impacted. That’s because a single compromised account with access to the “DNA Relatives” feature could match to 1,500 or more users who weren’t directly compromised. The cybercriminal would have access to any details those matches had chosen to share and, of more concern, the shared DNA segments.
To be clear, we don’t yet know whether the cybercriminal accessed segment data. What we do know is that the privacy risks are severe if they did. With segment data, one can infer genetic disease status for complete strangers, as I showed for cystic fibrosis back in early 2017, when the databases were a fraction of the size they are today. The risks now are far more wide-reaching.
We Need 23andMe’s Chromosome Browser, Even When We Don’t
The loss of the chromosome browser is a necessary (and one hopes temporary) evil to protect the genetic privacy of DNA testers. Genealogists who rely on segment data will be most impacted. At 23andMe, though, it poses an extra challenge: if we can’t access the chromosome browser, we can’t see how many centimorgans we share with our matches.
23andMe is unique among the main genetic genealogy databases in that, by default, it reports the percent shared DNA rather than centimorgans. The centimorgan value is only visible when both parties have opted into the “Advanced DNA Comparison” feature (a.k.a., the chromosome browser).
This is a big problem for us genealogists, because centimorgans are a better predictor of relationship than percentage. A simple analogy using travel distance versus time explains why.
Imagine three towns—Alphaville, Muberg, and Omegatown—that are exactly 50 miles from one another as the crow flies. Percent shared DNA is a bit like crow-miles; it’s a fixed distance. Percent DNA is calculated using base pairs, the chemical building block of DNA.
Travel time is a different matter entirely. In our little imaginary world, there’s a train between Muberg and Omegatown, so it’s a relatively quick 40 minutes. The road between Alphaville and Muberg is undergoing construction, so traffic slows down in spots and drive time is more than an hour. And the trip from Omegatown to Alphaville is a scenic route along a narrow, winding road that takes 2 hours. Driving speed is analogous to centimorgans; some “miles” in our genomes have more centimorgans than others.
Just as time is more important than absolute distance in commuting, centimorgans are more important than percent DNA in genealogy. Now that we can no longer see centimorgan amounts at 23andMe, we need a new approach to relationship prediction.
Seventy Four Point Five
That approach is simple: 74.5. Multiply the percent DNA by 74.5 to get a rough estimate of centimorgans. It’s not perfect, for the same reason that miles don’t convert linearly to commute time, but it’s the best option we have at the moment. (74.5 is the conversion factor used in the tools at DNApainter.com.)
I arrived at this conversion factor several years ago by comparing dozens of matches to several volunteers for whom I had both centimorgan and percent values at 23andMe. This was the number that gave the best approximation to the real centimorgan amounts across the board.
There’s another hitch with 23andMe, which is that they include X-chromosome segments in their total amount of shared DNA, which the other companies don’t do. The 74.5 conversion factor will be less accurate for matches who share X-DNA at 23andMe.
Hopefully, 23andMe will implement new security measures soon and restore the tools we genealogists need. Until then, all is not lost. We can make do with the 74.5 conversion factor in the meantime.
Thank you for the explanation of the 23andMe percentage shared figure. I hadn’t given any thought to the difference in that figure and a sum of the length of shared segments.
We’ll all watch to see what further fallout turns up. Fingers crossed!
You said “MyHeritage has done the same, although they haven’t publicly stated why.”
The chromosome browser at MyHeritage seems to be working just fine for me. Am I missing something or did I just misunderstand your statement?
The chromosome browser has been removed from my account entirely and from the other accounts I’ve seen.
Wow, it worked last night, but appears to be gone today. 🙁
My Heritage is not showing theirs either..sigh. And they have been limiting the amount of matches you see in a day. Its becoming very difficult to work at many of the sites.
Hopefully, these changes are temporary.
Many thanks for explaining that in plain English and especially for giving us hope that 23andMe might restore it to every user who changed their passwords.
Also thank you for 74.5 conversion from %DNA to centimorgans. I still don’t understand how I can share 95% of my DNA with great apes but only 50% with my sister.
That’s a great question for a future blog post!
Thanks for this explanation 🙂
The loss of the chromosome browser is a real shame, at both 23andme and at MyHeritage. One of MyHeritage’s competitive advantages was the chromosome browser and unique icon that flagged triangulations. I hope these features are restored. Until then, the value of the sites for genetic genealogists are significantly diminished.
Thank you for keeping us in the loop, Roberta. It’s getting wild out there. Now I have absolutely nothing on My Heritage, no matches, no notes, no tools. Hoping this is a temporary glitch.
You’re welcome, but this isn’t Roberta’s blog! She’s over at DNA Explained.
I don’t think it is legal for 23 and Me to remove their chromosome browser. I have paid them to use that feature and the loss of that changes the value proposition so they should refund my purchase price.
Seconfly, I don’t think it is appropriate for them to remove their chromosome browser. The fact that some users have not been using secure practices with their passwords is not the fault or responsibility of 23 and Me, nor is it mine. Yet the rest of us are being made to suffer and lose our privileges and the rights we have purchased.
I think it’s time for a class action lawsuit.
There’s nothing illegal about a company changing the services it offers, and it’s entirely appropriate for them to protect their users. A class-action lawsuit is not an option, as their updated Terms of Service has a mandatory arbitration clause.
We can expect Ancestry to point to this as more reason for them to NOT offer a chromosome browser.
AncestryDNA has consistently said that they think a chromosome browser is a privacy risk.
They are probably right. ThruLines(TM) is their alternative offering to find connections, and has been wonderful for me but still suffers from absent or vestigial trees in around 90% of my matches. I also have some puzzles that I could choose to waste time and subscription money on at Ancestry, but I have solved through segments and records elsewhere with considerable savings on both.
(Oh, and that’s without considering large chunks of my family for which the records are not at Ancestry anyway.)
Too many of my 23&me relatives only match me on X, often at 30cM or more. I have long wanted a way to filter them out. So I would not trust the multiplier hack.
Unfortunately, if we can’t see the chromosome browser, we don’t have a choice.