The 2023 data breach

analysisAccording to the company's August 2025 disclosure statement, on October 1, 2023 a threat actor posted online a claim to hold users' profile information. The investigation with outside incident-response experts found that the actor had logged into about 0.1% of accounts whose usernames and passwords had been reused from other, previously compromised websites and, through them, reached information users had chosen to share in the DNA Relatives and Connections features: personal information of about seven million customers, generally ancestry information and, for a subset, genetics-based health information. Testifying to the Senate Judiciary Committee on June 11, 2025, interim chief executive Joseph Selsavage put the directly accessed accounts at about 14,000 and the affected DNA Relatives users at more than 6 million; he said the company disabled the affected accounts and the feature, forced password resets, engaged cybersecurity firms, notified authorities and customers, made two-step verification mandatory and regretted the incident, one of the causes of the bankruptcy. ^{1 2}

analysisThe Privacy Commissioner of Canada and the UK Information Commissioner, investigating jointly, found that the attack began on April 29, 2023 and gave the hacker access to more than 18,000 accounts over five months. 23andMe told them that almost 7 million customers were affected worldwide, including almost 320,000 in Canada and 155,600 in the UK; the data reachable included health, ethnicity, relatives, date of birth and sex, much of it derived from DNA. Their chronology records that in July 2023 the hacker logged into one free account more than a million times in a day and later tried to start profile transfers in 400 accounts, which 23andMe investigated without recognising a wider breach; that in August 2023 a claim of stolen data on more than 10 million users, sent through the support portal and repeated on Reddit, was dismissed as a hoax; and that in October 2023 the data was advertised for sale and the breach confirmed. ¹

analysisThe commissioners found that 23andMe lacked safeguards suited to the sensitivity of the data. Multi-factor authentication was optional and used, with single sign-on, by fewer than 22% of customers, which the company said it had chosen to avoid friction; passwords needed only eight characters, compromised passwords were not checked, raw DNA data had no extra protection and monitoring did not flag the attack; after the breach it took four days to end all sessions and about a month to disable raw DNA downloads and make multi-factor authentication mandatory. Canada held that 23andMe contravened Principle 4.7 of PIPEDA and the UK that it infringed Articles 5(1)(f) and 32(1) of the UK GDPR. 23andMe told both offices of the improvements made since, and the Canadian Commissioner found the issue well-founded and resolved in light of them. ¹

analysisThey also found the breach notifications incomplete: reports to the regulators omitted known information, notably about raw DNA data, notices to individuals did not fully describe the data or say that some of it had been posted for sale, and holders of directly accessed accounts were told only in January 2024. Canada found contraventions of section 10.1 of PIPEDA and the UK breaches of Articles 33(3) and 34 of the UK GDPR, although on timing both accepted that the report to them was made as soon as feasible or for an accepted reason. 23andMe told them of improvements to its notification process, and the Canadian Commissioner found this issue too well-founded and resolved. ¹

analysisOn June 5, 2025 the UK Information Commissioner served a penalty notice, addressed to 23andMe, Inc. and 23andMe Holding Co., requiring 23andMe, Inc. to pay £2,310,000 for infringing Articles 5(1)(f) and 32(1) of the UK GDPR between May 25, 2018 and December 31, 2024. It found that the attacker obtained data on 155,592 UK customers, including health and genetic data, that the data was offered for sale in August and October 2023 in posts suggesting customers were targeted by ethnic background, and that the late detection and incomplete notices aggravated the infringement. 23andMe argued in April 2025 that, given its finances, no penalty should be imposed because it would deplete funds for claimants. ¹

analysisThe Commissioner started from the higher statutory maximum of £17.5 million, applied a 20% turnover adjustment, because the holding company's projected 2025 turnover was near the lower end of the £100–250 million band, and a 60% seriousness adjustment, giving £2,100,000, then added 10% for aggravating factors to reach £2,310,000, about 2.3% of projected turnover. Noting the parent's accumulated deficit of $2.4 billion and $79.4 million of unrestricted cash at December 31, 2024, he made no further reduction because the company was selling its business through Chapter 11 and intended to keep operating. The penalty was lower than the £4,593,750 proposed in the notice of intent; the notice allowed an appeal to the First-tier Tribunal within 28 days, and the record does not show whether one was brought. ¹

analysisBefore the bankruptcy, according to the disclosure statement, the Federal Trade Commission served a civil investigative demand in March 2024, attorneys general of 42 states and the District of Columbia opened a multistate investigation and 12 foreign regulators made inquiries; a UK firm also made a pre-arbitration demand for 3,720 UK customers. After the filing the debtors reported, besides the UK penalty, a letter of July 21, 2025 from the Spanish Data Protection Authority imposing a fine of 2,400,000 (about $2.8 million; the disclosure statement prints it with a pound sign and the Spanish decision was not retrieved), a civil investigative demand from the South Dakota Attorney General and shareholder demand letters about pre-bankruptcy conduct. ¹

analysisIn a suit announced on May 28, 2026, California's Attorney General alleges that a threat actor went undetected for five months, using about 14,000 accounts accessed with credentials stolen in earlier breaches, including that of the partner genealogy site MyHeritage, and a coding error in DNA Relatives to obtain data on nearly 7 million customers, 855,541 of them Californians; that data on one million people was offered for sale advertised as belonging to Asian American and Pacific Islander and Jewish users; and that 23andMe told the public there was no security incident, downplayed the stolen data and blamed customers. The complaint further alleges that engineers saw a spike of 1,300 log-in requests a minute from one IP address on July 6, 2023, that the security team knew of the August 2023 Reddit post two months before the October 1 discovery date the company gives, and that multi-factor authentication became mandatory only on November 6, 2023. These are allegations in a pending suit; the company's own account attributes the access to reused passwords and describes the resets, the disabling of DNA Relatives and the mandatory two-step verification. ^{1 2}

analysisThe complaint also alleges that on October 7 and 8, 2023 the actor messaged three people, including Anne Wojcicki, then chief executive, and that between October 8 and 25 the company negotiated with the actor and paid $400,000 in cryptocurrency for a report on the vulnerabilities used and two more, destruction of the data, deletion of posts about the breach and a cover story mitigating its severity, while its blog of October 6 said it had no indication of an incident in its systems; it says it is unknown whether any data was deleted. No court has found these allegations proven, and no response to them by the company, the trust or Wojcicki was found in the record; the trust's May 31, 2026 motion in the bankruptcy court concerned whether California's claims were barred. ^{3 2}