Industry - Data Breach

moderateAnti-PrivacyJul 20, 2026 → Jul 20, 2026Data Breach

Executive Summary

A 2023 data breach at genetic testing company 23andMe compromised the genetic data and personal information of 6.9 million customers worldwide, including over 80,000 South Carolina residents and 192,000 Pennsylvania residents. Attorneys general from 42 states reached an $18 million settlement with the now-bankrupt company, which investigators found failed to implement basic security measures like multifactor authentication and breach detection tools, and initially denied the breach before bla...

Post LinkedIn Reddit Email

data-breach

What Happened

In October 2023, genetic testing company 23andMe suffered a data breach that compromised the personal and genetic information of 6.9 million customers worldwide, including detailed ancestry data, health information, and raw genetic code. The breach occurred through credential stuffing attacks where hackers used stolen passwords from other websites to access 23andMe accounts. The company discovered the breach months after affected data had already been posted for sale on the dark web, initially denied responsibility, then blamed customers for poor password practices before finally acknowledging its security failures.

Who Is Affected

Approximately 6.4 million U.S. customers had their genetic and personal data exposed, including 192,000 in Pennsylvania, 80,000 in South Carolina, and 69,000 in Kentucky. The breach exposed highly sensitive information including names, birth dates, gender, familial relationships, contact details, health records in some cases, and most critically, raw genetic code linked to individual user profiles. An additional 400,000 international customers were also affected, bringing the total to 6.9 million people worldwide whose genetic ancestry information and related personal data were compromised.

Why It Matters

This breach represents one of the largest compromises of genetic data in history, exposing irreplaceable biometric information that cannot be changed like passwords or credit cards. Investigators found 23andMe failed to implement basic security measures including multifactor authentication, breach detection tools, rate limiting to stop automated attacks, or monitoring for unusual login spikes despite handling extraordinarily sensitive genetic data. The company's bankruptcy and subsequent sale of customer genetic data to a nonprofit formed by its own founder raises ongoing concerns about custodianship of this permanent biological information, establishing a troubling precedent for accountability in the genetic testing industry.

What You Should Do

If you were a 23andMe customer, check whether you filed a claim in the class-action settlement by the February 17 deadline to receive part of the $46.75 million consumer fund, and verify if your state received settlement funds you may be entitled to. Immediately enable multifactor authentication on all accounts where you've used the same or similar passwords as your 23andMe account, and change those passwords to unique, strong alternatives. Monitor your credit reports and consider placing fraud alerts, as the exposed personal information combined with genetic data could be used for identity theft or insurance discrimination. Be vigilant for targeted phishing attempts or scams that reference your genetic information, and understand that unlike financial data, your genetic information can...

Summary generated from verified sources and reviewed before publication. How we summarize.

Sources

Related Events