An $18 million settlement is the most recent consequence of 23andMe’s 2023 knowledge breach—and a reminder that some stolen data can by no means get replaced.
The genetic testing firm has agreed to settle allegations introduced by attorneys normal from 43 states, who argued stronger safety measures might have restricted the impression of an assault that in the end uncovered knowledge tied to just about 7 million individuals.
The settlement follows an investigation by greater than 40 state attorneys normal into the corporate’s dealing with of the 2023 breach, which attackers carried out utilizing credential stuffing quite than a direct compromise of 23andMe’s techniques. Regulators argued that stronger account protections and safety controls might have decreased the impression of the assault.
Though solely 1000’s of buyer accounts have been accessed, attackers leveraged the corporate’s DNA Kinfolk characteristic to gather knowledge from thousands and thousands of genetically related customers. The case’s impression is critical, not simply due to the numbers, however as a result of genetic knowledge is unattainable to alter.
Particulars of the settlement
BleepingComputer reviews that 43 state attorneys normal accused 23andMe of failing to adequately defend prospects’ extremely delicate genetic and private data after attackers exploited reused passwords to entry person accounts again in 2023.
In an announcement made on Tuesday, New York Legal professional Basic Letitia James famous that “23andMe put thousands and thousands of its prospects in danger with its flimsy safety measures.” James additionally confirmed {that a} multistate investigation was carried out, the outcomes of which led to the lawsuit.
Moderately than proceed litigating these claims, 23andMe agreed to an $18 million settlement as a part of its ongoing chapter proceedings. The corporate additionally lately modified possession and is now owned by TTAM Analysis Institute, a not-for-profit group.
James’ assertion additionally famous that New York’s share of the $18 million is $705,000, with 305,245 individuals within the state affected.
Should-read safety protection
How the 2023 breach affected thousands and thousands
Though solely about 14,000 buyer accounts have been instantly accessed through the 2023 cyberattack, data linked to roughly 6.9 million individuals was in the end uncovered. The attackers achieved this by credential stuffing, utilizing usernames and passwords obtained from unrelated knowledge breaches to log into accounts the place prospects had reused the identical credentials.
As soon as inside, the attackers abused the corporate’s optionally available DNA Kinfolk characteristic, which permits customers to find and join with genetically associated people. That enabled them to scrape profile and ancestry data linked to thousands and thousands of further customers, increasing the breach far past the accounts that have been initially compromised.
The uncovered knowledge various by person however included data comparable to names, delivery years, areas, ancestry reviews, household surnames, relationship particulars, profile pictures, and genetic match data, relying on what people had chosen to share by the platform.
Why this issues past a financial settlement
Not like passwords or cost playing cards, genetic data can not merely be modified after it’s uncovered. It could actually reveal ancestry, organic relationships, and different deeply private particulars that will stay related for a lifetime, making breaches involving DNA knowledge significantly troublesome to include whereas opening up a variety of potential misuse and abuse.
The settlement serves as a reminder that whereas breaches could also be unavoidable, the private data shared on-line must be weighed fastidiously—particularly when it can’t be changed.
The usage of credential stuffing additionally highlights why readers ought to monitor for credential breaches utilizing providers like Have I Been Pwned, change their passwords, and arrange multifactor authentication.
Additionally Learn: The largest knowledge breaches up to now in 2026 and what they’ve in widespread.
