California Sues 23andMe Over Alleged Failures in 2023 Data Breach
Summary
California’s attorney general sued 23andMe, alleging it failed to protect genetic data in a 2023 breach affecting nearly 7 million people. The company has acknowledged the breach; the lawsuit seeks civil penalties and injunctions.
Key points
- California Attorney General Rob Bonta sued Chrome Holding Co., the company formerly known as 23andMe, seeking civil penalties and injunctions over alleged privacy-law violations.
- 23andMe has acknowledged a 2023 breach in which about 14,000 accounts were accessed and data from nearly 7 million customers was stolen.
- The attack used credential stuffing, according to the article; the lawsuit says attackers used stolen credentials and alleges 23andMe did not require password resets or multifactor authentication after an earlier partner breach.
- The lawsuit alleges 23andMe missed warning signs, including a spike in login attempts in July and an August Reddit post discussing a possible breach.
- Stolen information reportedly included raw genetic data, health reports, DNA shared with relatives, and relatives’ locations and birth years.
- Prosecutors allege the threat actor operated undetected for more than five months; 23andMe said it learned of the breach when data appeared for sale in October 2023.
Article Details
- Event Type
- California civil lawsuit alleging that 23andMe failed to protect user data in the 2023 breach and violated state privacy laws.
- Impact
- The breach involved access to about 14,000 accounts and theft of data belonging to nearly 7 million customers, including raw genetic data, health reports, shared DNA, and relatives’ locations and birth years. Prosecutors alleged that the threat actor operated undetected for more than five months and that the company did not adequately investigate earlier warning signs. The lawsuit seeks civil penalties and injunctions. Separately, 23andMe agreed to a settlement resolving most U.S. customer claims, increased to $50 million and finally approved in January.