23andMe fined £2.31 million over genetic data breach that exposed UK users

Data protection watchdog slams DNA testing firm for weak security after 155,000 Britons’ sensitive data compromised in major cyber attack

The UK’s Information Commissioner’s Office (ICO) has fined genetic testing company 23andMe £2.31 million for “serious security failings” that allowed hackers to access sensitive information of more than 155,000 UK users.

The breach – described as “profoundly damaging” by Information Commissioner John Edwards – saw hackers gain access to names, birth years, addresses, profile photos, ethnicity, family tree data and even raw health reports from UK customers of the popular home DNA kit brand.

One affected customer told the ICO: 

“Disgusted that my DNA data could be out there in the wild and been exposed to bad actors. Extremely anxious about what this could mean to my personal, financial and family safety in the future.”

Have you been affected by this data breach? Read our advice below and use our template to request deletion of your genetic and personal data if you no longer wish to keep your information on the platform.

ICO: 23andMe’s security ‘inadequate’ and response ‘slow’

The hack, which occurred between April and September 2023, was made possible by a tactic known as credential stuffing – where stolen login details from other services are used to access accounts. 

The ICO found that 23andMe failed to implement even basic safeguards, such as two-factor authentication, strong password protocols or anomaly detection systems.

“This was a profoundly damaging breach that exposed sensitive personal information, family histories and even health conditions of thousands of people in the UK,” said Edwards. “Once this information is out there, it cannot be changed or reissued like a password or credit card number.”

The firm also failed to detect and properly respond to early signs of suspicious activity. According to the ICO, the company only launched a full investigation in October 2023 – after a 23andMe employee spotted their customers’ stolen data being sold on Reddit.

23andMe files for bankruptcy 

The fine comes at a turbulent time for 23andMe, which filed for bankruptcy protection in the US this March after months of mounting financial losses and reputational damage.

Former CEO Anne Wojcicki now appears set to retake control of the company. Her non-profit firm recently outbid pharmaceutical giant Regeneron in a bankruptcy auction, offering $305 million (£226 million) compared to Regeneron’s $256 million (£190 million). The deal is expected to close in the coming weeks.

But the potential sale has raised fresh privacy concerns about what could happen to millions of people’s genetic information. Privacy experts are urging 23andMe users to log in and request deletion of their data, warning that it could be vulnerable to misuse if sold or transferred to another party.

Regulatory wake-up call for firms handling sensitive data

The £2.31 million penalty follows a joint investigation by the UK’s ICO and the Office of the Privacy Commissioner of Canada. Canadian Commissioner Philippe Dufresne warned that the case should serve as a wake-up call to all firms handling sensitive data.

“Any organisation that is not taking steps to prioritise data protection and address these threats is increasingly vulnerable,” Dufresne said. “This investigation shows how regulatory collaboration can more effectively address issues of global significance.”

What you should do if you’re a 23andMe user

The ICO said it had received multiple complaints from UK consumers concerned about identity theft, genetic profiling, and discrimination. 

If you’ve used 23andMe’s services, particularly before September 2023, consider taking these steps:

• Check if your account was affected by logging into your dashboard and reviewing any security notifications.
  
• Update your login credentials and enable two-factor authentication.
  
• Request deletion of your genetic and personal data if you no longer wish to keep your information on the platform – use our template, below.
  
• Stay alert for suspicious activity, especially if you’ve used the same passwords across multiple sites.

If you’ve been affected by this cyber attack – or want to prepare for similar incidents in the future – here are some practical steps to protect yourself.