23andMe

Summary

The genetic testing company experienced a credential stuffing breach that exposed the personal and genetic information of millions of customers, with the data later offered for sale on the dark web. Following the incident, multiple state attorneys general filed lawsuits alleging inadequate security practices, leading to a series of settlements totaling tens of millions of dollars and additional fines from international regulators. The company subsequently filed for bankruptcy, sold its assets to a nonprofit affiliated with its founder, and agreed to implement new security measures including risk analysis, an advisory board, and continued consumer data deletion rights as part of the settlements.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

In October 2023 23andMe disclosed that cybercriminals had accessed customer profile information through a credential stuffing campaign, explaining that the attackers used login credentials recycled from other breaches to gain unauthorized entry to accounts where users had reused usernames and passwords. The company said the intrusion was not the result of a direct compromise of its own network but stemmed from weak password practices and the absence of multi‑factor authentication on affected accounts. According to the breach notice, the exposed data included names, addresses, birth years, locations, genetic ancestry reports, health reports and DNA Relatives profile information for individuals who had opted into that feature, with the total number of affected individuals estimated at between six and seven million across the United States and internationally. The stolen data appeared for sale on dark web forums in October 2023, where a threat actor advertised packages ranging from one hundred profiles for one thousand dollars to one hundred thousand profiles for one hundred thousand dollars and claimed to have compiled a “one million Ashkenazi database.” Investigations by the California Department of Justice later determined that the attackers had operated undetected within 23andMe’s systems for more than five months before the company began its inquiry, which only started after the data were offered for sale on the dark web.

The breach triggered a wave of legal and financial repercussions. In March 2025 23andMe filed for Chapter 11 bankruptcy protection, citing the breach, related litigation, increased competition and falling demand for genetic testing products as contributing factors. A coalition of forty‑two state attorneys general reached an $18 million settlement with the company, which also required 23andMe to pay more than $705 000 to New York and to adopt new data protection measures such as risk analysis, an advisory board on data security and continued availability of a consumer data deletion option. Separately, a U.S. bankruptcy judge approved a $46.75 million class‑action settlement for breach victims in July 2026, of which $14.29 million had already been disbursed, leaving an additional $32.46 million available for distribution. The company also settled claims with Canadian class members for $3.25 million and with arbitration claimants for $9 million. Regulatory fines followed, including a €2.4 million ($2.75 million) penalty from Spain’s privacy watchdog for affecting 2 642 Spanish customers and a £2.3 million ($3.1 million) fine from the UK Information Commissioner’s Office for failing to protect special category data. California Attorney General Rob Bonta filed a lawsuit against the post‑bankruptcy entity Chrome Holding Co., alleging violations of the California Genetic Information Privacy Act, Reasonable Data Security Law, False Advertising Law, Unfair Competition Law and the California Consumer Privacy Act, and asserting that the company had ignored known security vulnerabilities, misled consumers about the breach’s severity and failed to investigate early warning signs such as a suspicious spike in login attempts in July 2023 and a Reddit post in August 2023 discussing a possible data sale.

In response to the incident 23andMe announced a series of security actions beginning in early October 2023. The company required all customers to use email‑based two‑step verification, automatically enrolling new accounts and existing accounts that lacked an authenticator app, and prompted existing users to receive a verification code at their next sign‑in. It also mandated that every customer reset their password and encouraged the adoption of multi‑factor authentication, while temporarily disabling the DNA Relatives tool as a precautionary measure. 23andMe engaged third‑party forensic experts and cooperated with federal law‑enforcement officials throughout the investigation, and it notified affected individuals directly when unauthorized access to their data was confirmed. The firm continued to monitor and audit its systems, maintained its ISO certifications and advised users to employ strong, unique passwords and to enable multi‑factor authentication as part of its ongoing security communications. These steps were presented as part of the company’s effort to restore confidence and to prevent recurrence of credential‑stuffing attacks.

Sources

Sources available to members: 12 sources.