23andMe

Profile narrative

23andMe is a direct‑to‑consumer genetic testing company that provides ancestry composition reports, health‑related genetic risk assessments, and traits analysis through saliva‑based kits. The service is marketed to individuals interested in learning about their genealogical origins and potential health predispositions. In addition to consumer offerings, the company operates a research institute that uses aggregated, de‑identified genetic data for scientific studies and partnerships with academic and pharmaceutical organizations. Its primary market consists of consumers in the United States, but it also serves customers in Europe and other regions where its tests are available online.

The company’s reach has been described in terms of the number of individuals whose data it has handled; for example, a credential‑stuffing breach in October 2023 exposed the personal and genetic information of millions of customers, and a separate incident in April 2023 involved genetic data from about 6.9 million users, including over 2,600 individuals in Spain. These figures indicate that 23andMe has accumulated a substantial user base that spans multiple countries. The firm’s activities have attracted attention from regulators in various jurisdictions, as evidenced by fines imposed by Spain’s data protection authority and settlements with numerous U.S. state attorneys general.

23andMe’s distinguishing attributes include its specialization in direct‑to‑consumer genomics, its integration of consumer testing with a research division, and its repeated encounters with data‑protection regulators over security practices such as missing multifactor authentication and weak password policies. After the 2023 breaches, the company faced legal actions that resulted in settlements totaling tens of millions of dollars, agreed to implement risk analyses, create an advisory board, and maintain consumer data deletion rights. Following financial strain, 23andMe filed for bankruptcy, sold its assets to a nonprofit affiliated with its founder, and committed to the security measures outlined in the settlement agreements.

Incidents

2 incidents linked to this organisation.