MyHeritage is a genealogy and consumer DNA-testing service run by MyHeritage Ltd. (Israel), acquired by private-equity firm Francisco Partners in April 2021; founder Gilad Japhet continued as CEO with no reported personnel or product changes. Its own Privacy Policy states it has never sold or licensed genetic or health data and never will without explicit consent, will not provide data to insurers or employers, and will not give data to law enforcement absent a valid court order or subpoena for genetic information -- but the same policy discloses broad collection (DNA samples, a health questionnaire, biometric facial-recognition models via its opt-in Photo Tagger feature, family-tree and web-behavior data) and routine sharing with infrastructure and AI service providers (Amazon, Google Cloud, OpenAI, Microsoft Azure, PWNHealth). In October 2017 an outside security researcher found a file containing 92,283,889 users' email addresses and hashed passwords on a server outside MyHeritage's infrastructure; MyHeritage disclosed this on its blog in June 2018, stating no DNA or genetic data was involved and passwords were stored as per-user-salted one-way hashes.
TRACK RECORD
1 BREACH
[2017-10-26] · BREACH
Have I Been Pwned lists a breach record for MyHeritage: "MyHeritage".
Approximately 91,991,358 accounts affected, per HIBP.
MyHeritage's Apple App Store privacy label lists Purchases, Contact Info (Email Address, Name, Phone Number), and Identifiers (User ID) among the data 'Linked to You,' with Purchases, Contact Info, and Identifiers specifically used for the developer's own Advertising or Marketing purposes.
MyHeritage's Privacy Policy states DNA-related information is generated and stored when a user purchases a DNA test kit or uploads DNA data from another testing service, that a self-reported Health Questionnaire is collected before DNA Health Reports are provided, and that its opt-in Photo Tagger feature creates biometric facial-recognition models of users and their deceased relatives -- collection considerably broader than the core family-tree-building feature.
MyHeritage's Apple App Store listing identifies the app's seller as 'MyHeritage Ltd,' independently corroborating the operating legal entity named in the company's own materials.
MyHeritage's own blog post (published 2021-04-08) states the company was acquired by private equity firm Francisco Partners, that founder and CEO Gilad Japhet continued to lead the team with no personnel changes and no changes to the product roadmap, and that prior investors were replaced by Francisco Partners.
MyHeritage's blog post announcing its April 2021 acquisition by Francisco Partners states that, as a first step under the new ownership, the company would shortly update its privacy policy to add an unequivocal prohibition on licensing or selling genetic data -- a specific commercial commitment tied to the ownership change.
MyHeritage's Privacy Policy states, emphasized in capital letters, that personal information including genetic and health information will never be sold or licensed to third parties -- including pharmaceutical companies, government agencies, insurance companies, or a user's employer -- without explicit consent, and separately states MyHeritage will not provide information to law enforcement unless required by a valid court order or subpoena specifically for genetic information.
Have I Been Pwned's breach catalog lists the "MyHeritage" incident (myheritage.com), breach date 2017-10-26, affecting approximately 91,991,358 accounts. Data classes exposed per HIBP: Email addresses, Passwords. Source: Have I Been Pwned (haveibeenpwned.com), CC BY 4.0.
MyHeritage's blog post (published 2018-06-04) disclosed that a security researcher had found a file containing the email addresses and hashed passwords of 92,283,889 users who had signed up through October 26, 2017, on a server outside MyHeritage's infrastructure; MyHeritage stated it does not store plaintext passwords, only a one-way hash with a hash key that differs per customer, and reported no evidence the data had been used by the perpetrators.
MyHeritage's Apple App Store privacy label lists Purchases, Contact Info, User Content, Search History, and Identifiers as data linked to identity used for Analytics purposes -- first- or third-party usage analytics tied to a signed-in user's identity, though the label discloses no separate 'Data Used to Track You' cross-app advertising category.
MyHeritage's Privacy Policy states its opt-in Photo Tagger feature uses facial recognition technology, powered by Amazon, to create facial recognition models -- described in the policy as biometric information -- of the user and their deceased relatives to assist with photo tagging; the same policy separately states MyHeritage does not modify a user's online experience based on a browser's Do-Not-Track signal.