23andMe Agrees to $6 Million California Settlement Over 2023 Hack
Summary
23andMe agreed to a proposed $6 million California settlement over its 2023 hack, pending court approval. Affected consumers retain the right to request deletion of their information and destruction of saliva samples.
Key points
- The proposed agreement was filed in federal bankruptcy court and requires court approval.
- California's lawsuit alleged 23andMe failed to protect customers’ personal and genetic information.
- The settlement preserves affected consumers’ right to request deletion of their information and destruction of their saliva samples.
- The 2023 credential-stuffing attack began with about 14,000 compromised accounts using reused passwords; the DNA Relatives feature exposed information associated with approximately 6.9 million users.
- Separate settlements include $46.75 million for victims and $18 million over claims by 43 other states; the UK's data protection regulator also imposed a £2.31 million fine.
Article Details
- Event Type
- Proposed $6 million settlement of California litigation over the 2023 23andMe data breach
- Impact
- The proposed settlement would resolve California's claims that 23andMe failed to protect customers' personal and genetic information. Affected consumers retain the right to request deletion of their information and destruction of their saliva samples. The underlying credential-stuffing attack affected approximately 6.9 million users, including 855,000 Californians.
MITRE ATT&CK
People
Products
23andMeChrome Holdings - better known as 23andMe - has agreed to pay $6 million to settle litigation filed by California's department of justice against the genetic testing firm in aftermath of a 2023 hack that affected nearlyDNA Relativesinitially compromised about 14,000 customer accounts using reused passwords, but used 23andMe's DNA Relatives feature to access personal information associated with approximately 6.9 million users.