23andMe to Pay $18 Million to Settle Claims Over 2023 Genetic Data Breach
Summary
23andMe agreed to pay $18 million to settle claims from 43 attorneys general over its 2023 breach, in which attackers reportedly stole genetic data from 6.9 million customers. Investigators cited missing safeguards and failures to address suspicious logins and known vul
Key points
- 23andMe agreed to an $18 million settlement with a coalition of 43 attorneys general over claims that it failed to protect customers’ genetic data.
- The company disclosed the breach in October 2023 after credential-stuffing attacks reportedly went undetected from April through September.
- Attackers stole data from 6.9 million customers, including genetic ancestry information; some data was later offered for sale and leaked.
- A multistate investigation cited missing safeguards including multifactor authentication, password blocklisting, rate limiting, intrusion prevention, and breach-detection monitoring.
- Investigators also found that 23andMe failed to address unusual login activity and fix known vulnerabilities.
- The settlement sets security requirements for TTAM, including a data security advisory board and risk analysis protocols, and preserves consumers’ rights to delete their data.
- The breach also led to class-action litigation and a UK ICO fine; TTAM completed its acquisition of 23andMe in July 2025.
Article Details
- Victim Organization
- 23andMe
- Incident Type
- Credential-stuffing attack and data breach
- Data Types Exposed
- Genetic ancestry information
- Genetic profiles
- Affected Records
- 6.9 million customers
- Operational Impact
- Attackers stole customer data during a five-month period from April to September 2023. Some data was offered for sale, and millions of genetic profiles were leaked.
- Ransom Or Extortion
- Stolen data was offered for sale and genetic profiles were leaked as proof of its legitimacy; no ransom demand is reported.
- Claim Status
- confirmed