On October 6, 2023, 23andMe confirmed that attackers had accessed information associated with approximately 6.9 million users—nearly half of the company’s reported 14 million customers. The company’s investigation attributed the incident to credential stuffing rather than a breach of its core IT systems: attackers used reused or compromised passwords to enter some accounts, then exploited the opt-in DNA Relatives feature to access information visible through those accounts. Exposed material could include names, birth years, locations, family surnames, ethnicity estimates, mitochondrial and Y-chromosome haplogroups, family-tree links, profile photos, and optional biographical text.
Data samples appeared on BreachForums in October 2023, while advertised datasets reportedly categorized people of Ashkenazi Jewish and Chinese descent, raising concerns about targeted exploitation of sensitive ancestry information. 23andMe temporarily restricted DNA Relatives features and raw-data downloads and later required two-factor authentication. Customers filed class actions alleging negligence, privacy violations, breach of contract, and unjust enrichment; a separate January 2024 suit alleged inadequate notice concerning curated lists offered on the dark web. In September 2024, 23andMe agreed to a $30 million settlement. A joint Canadian and U.K. investigation found inadequate protections and ignored warning signs, leading the U.K. Information Commissioner’s Office to impose a £2.31 million fine.
