The 23andMe breach: what happens when your DNA data leaks

Fourteen thousand accounts were opened with reused passwords. Through a sharing feature, millions more were exposed. What happened, what regulators found, and what to do now.

HARD JournalPrivate cybersecurity · 6 min read

The 23andMe data breach began with something ordinary: people using the same password on two websites. In 2023 attackers took passwords leaked from other, unrelated breaches and tried them on 23andMe. About 14,000 accounts opened. Because of a feature that lets relatives see each other's profiles, the company later said 6.9 million people had some information exposed.

It matters more than most breaches because of what sat behind those logins. A stolen password can be changed. Ancestry, health reports and a family tree can't.

What happened, and when

• April to September 2023. Attackers run repeated "credential stuffing" waves against 23andMe accounts. The UK Information Commissioner's Office (ICO) later found the activity was intense in May and again in September.
• August 2023. According to the ICO, the company dismisses a claim that data on more than ten million users had been stolen, treating it as a hoax.
• October 2023. Stolen data is advertised online. 23andMe says it learned of the compiled profile data on 6 October and starts a full investigation.
• December 2023. The company says the credentials were reused from elsewhere and that about 14,000 accounts were accessed directly. It puts the total of affected people at 6.9 million.
• January 2024. In a letter to lawyers acting for victims, reported by TechCrunch, 23andMe says users "negligently recycled and failed to update their passwords".
• September 2024. A US$30 million class action settlement is reported, covering US claims.
• March 2025. 23andMe files for Chapter 11 bankruptcy.
• June 2025. The ICO and Canada's Office of the Privacy Commissioner publish a joint investigation. The ICO fines the company £2.31 million.
• 27 June 2025. The bankruptcy court approves the sale of substantially all of 23andMe's assets for US$305 million to TTAM Research Institute, a nonprofit led by co-founder Anne Wojcicki.

How the attackers got in

There was no break-in to 23andMe's servers in the movie sense. Credential stuffing is simple: take email and password pairs leaked from other sites, and try each on a new one. It works because many people reuse passwords. The regulators found the pairs came from earlier breaches unrelated to 23andMe, and the company said its own investigation did not find that its systems were the source of the credentials.

The regulators' complaint was about what 23andMe hadn't done. The ICO's findings include no mandatory multi-factor authentication, weak password rules, and too little monitoring to notice the pattern, even as signs of the attack piled up for months. The Canadian regulator said the company also didn't notify regulators and customers as the law required. 23andMe's position, in the January 2024 letter, was that the incident was not the result of a failure to keep reasonable security.

A reused password turns one company's breach into every company's breach.

Why 14,000 accounts became 6.9 million

The multiplier was DNA Relatives, an opt-in feature that shows you people who share DNA with you. Once inside an account, an attacker could read what that user's matches had chosen to share. By 23andMe's own account, the attackers reached about 5.5 million DNA Relatives profiles and 1.4 million Family Tree profiles this way. Most of those people never had their own password guessed. A cousin's did.

What was taken, and who was affected

23andMe said the exposed information included display names, predicted relationships and the percentage of DNA shared with matches. The ICO lists names, birth years, location at city or postcode level, profile photos, race and ethnicity, family trees and health reports for the UK victims. The regulators' joint summary adds date of birth, sex at birth and DNA-derived information, varying by account.

The numbers differ by source, so here they are with their owners. 23andMe: about 14,000 accounts accessed directly, 6.9 million people affected in total, from about 14 million customers at the time. The ICO: 155,592 UK residents. The Canadian regulator: nearly 320,000 people in Canada, and about 7 million worldwide.

What the regulators and courts did

The ICO fined 23andMe £2.31 million on 17 June 2025 for failing to protect UK users' genetic data. The Canadian commissioner reached similar findings but, at the time, lacked the power to issue a penalty. In the US, the company agreed to pay US$30 million to settle class claims, according to reports in September 2024. Then came bankruptcy. When the sale was approved on 27 June 2025, five US states (California, Kentucky, Tennessee, Texas and Utah) were still opposed, and California's attorney general said the sale did not comply with state genetic privacy law. The buyer said it would honour existing privacy policies, allow customers to delete their genetic data and offer two years of identity monitoring.

What it means for a household or an executive

1. Genetic data is permanent. You can't reset it. It also describes your relatives, who never agreed to anything. Treat it like a medical record that lives with a company that can be sold.
2. Reused passwords gave attackers access, and missing security safeguards let the attack spread. One reused password at a site you've forgotten about is a way into everything that shares it. This is the same lesson as the AI keys breaches: the exposure is wherever you trusted something with access.
3. Lists like this get used for targeting. Ancestry, family names and location make a convincing phone call or email. Expect a message that knows more about you than a stranger should.

What to do today

1. Change the password, and every place you reused it. Use a different long password for every account, held in a password manager, and turn on two-step verification everywhere it is offered, starting with email.
2. Decide whether the data should exist. If you ever used 23andMe, or a similar service, check your account settings: you can delete your genetic data and your account, and ask for stored samples to be destroyed. Turn off any relative-matching feature you don't use.
3. Lock your credit file. In Australia, ask one of the three credit reporting bodies (Equifax, Experian or illion) for a free credit ban, and ask it to pass your request on to the other two, which it must do. Or contact each one yourself. A ban lasts 21 days, and you can extend it as many times as you need. In the US, a freeze with each of the three bureaus stays in place until you lift it. Both are free and make it harder for a stranger to open credit in your name. Do the same for children, who have no credit history to protect.
4. Protect your phone number. Ask your mobile carrier to add a PIN or port-out lock, so a scammer can't talk their way into moving your number to a new SIM.
5. Treat unexpected contact as a test. A call or message that mentions your ancestry, your relatives or your health results is a reason to hang up and call the company back on a number you looked up yourself.
6. Tell the people the data also describes. Close relatives share your exposure. Send them this page.

Or have someone keep that list for you. Knowing which companies hold the most sensitive things about your family, and what to do when one of them falls, is what private cybersecurity is for.

Sources