23andMe data breach

Between April and September 2023, a hacker accessed 23andMe using login credentials stolen from previous unrelated data breaches, exposing the personal information of 155,592 UK residents.

The hacker accessed a select number of individual 23andMe accounts – less than 0.1% of its then 14 million customers, approximately 14,000 accounts – through credential stuffing. Using those compromised accounts, the hacker was then able to access information connected to a significantly larger number of profiles. Approximately 5.5 million DNA Relatives profiles and 1.4 million Family Tree feature profiles were accessed as a result.

The personal information potentially exposed includes names, birth years, self-reported city or postcode-level location, profile images, race, ethnicity, family trees and health reports. The type and amount of information accessed varied depending on what each customer had included in their account.

23andMe’s response to the unfolding incident was found to be inadequate by the ICO. The hacker began their credential stuffing attack in April 2023. In August 2023, a claim of data theft affecting over 10 million users was dismissed as a hoax, despite 23andMe having conducted isolated investigations into unauthorised activity on its platform in July 2023. 

Another wave of credential stuffing followed in September 2023, but the company did not start a full investigation until October 2023, when a 23andMe employee discovered that the stolen data had been advertised for sale on Reddit.

In June 2025, the ICO fined 23andMe £2.31 million for failing to implement appropriate security measures to protect the personal information of UK users. The penalty followed a joint investigation conducted by the ICO and the Office of the Privacy Commissioner of Canada. 

The ICO found that 23andMe failed to implement appropriate authentication and verification measures, such as mandatory multi-factor authentication, secure password protocols or unpredictable usernames. It also failed to implement appropriate controls over access to raw genetic data and did not have effective systems in place to monitor, detect or respond to cyber threats.

What are your rights?

23andMe had a legal obligation to protect your personal data. The ICO has confirmed that 23andMe breached UK data protection law by failing to implement appropriate security measures, and fined the company £2.31 million as a result. As Information Commissioner John Edwards said: “This was a profoundly damaging breach that exposed sensitive personal information, family histories, and even health conditions of thousands of people in the UK.”

Genetic data cannot be changed or reissued in the way a password or credit card number can. This permanent nature of the harm, combined with the ICO’s confirmation that 23andMe failed in its legal obligations to UK users, is directly relevant to any compensation claim.

What data breach compensation could you receive?

There is no fixed amount. Each case is assessed on its own merits. Factors that are likely to be relevant include:

• Sensitivity of the data. This breach involved genetic data, health reports, race, ethnicity, family trees and health conditions – among the most sensitive categories of personal information that exist. The ICO has explicitly recognised this as a profoundly damaging breach. Claims involving this type of data are likely to attract higher awards than those involving basic contact details.
• The permanent nature of genetic data. Unlike a password or credit card number, your genetic information cannot be changed if exposed. The lifelong nature of this risk is directly relevant to the value of a claim.
• Distress and anxiety. The ICO received complaints from affected individuals describing feeling disgusted, extremely anxious and deeply concerned about what the exposure of their DNA data could mean for their personal, financial and family safety. These are recognised forms of non-material harm that can support a compensation claim.
• Risk of exploitation. The ICO has noted that the combination of postcodes, race, ethnic origin, familial connections and health data found in 23andMe accounts could potentially be exploited for financial gain, surveillance or discrimination.
• The ICO fine. The ICO’s decision to fine 23andMe £2.31 million confirms that the company breached UK data protection law. This regulatory finding is relevant to the strength of individual compensation claims.
• Financial loss. If you have experienced any suspicious activity, fraud or financial loss that can be linked to the breach, this would strengthen a claim further.

Frequently asked questions