23andMe Breach: When Your DNA Becomes the Stolen Data
The 23andMe data breach exposed genetic information of 6.9 million users through credential stuffing attacks exploiting the DNA Relatives feature. Unlike credit card numbers or passwords, genetic data cannot be changed. The breach included ancestry information, genetic health predispositions, and family connections that could be used for discrimination, surveillance, or targeting of ethnic groups. 23andMe subsequently filed for bankruptcy, raising urgent questions about what happens to genetic databases when biotech companies fail.
What Was Exposed
23andMe confirmed attackers accessed profiles of 6.9 million users through credential stuffing, using passwords leaked from other breaches to access accounts. The DNA Relatives feature meant accessing one account exposed connected family members data. Stolen information included genetic ancestry results, birth years, locations, family connections, and in some cases health predisposition reports. The data is permanently sensitive because genetic information is immutable.
Bankruptcy and Data Fate
23andMe filed for Chapter 11 bankruptcy in 2024, raising critical questions about the disposition of genetic data for 15 million customers. Privacy advocates warned that genetic databases could be sold as assets during bankruptcy proceedings, potentially ending up with entities that never agreed to the original privacy terms. Multiple state attorneys general intervened to prevent data sale, but legal protections for genetic data during corporate bankruptcy remain inadequate.
Unique Risks of Genetic Data Breaches
Genetic data breaches differ fundamentally from traditional data breaches. You cannot change your DNA like a password. Genetic information reveals predispositions to diseases that could affect insurance, employment, and relationships. Family connections expose relatives who never consented to testing. Ancestry data can be used to target ethnic groups. The Genetic Information Nondiscrimination Act provides some protection but excludes life insurance, disability insurance, and long-term care insurance.
Key Findings
- 6.9 million users genetic data exposed through credential stuffing exploiting the DNA Relatives feature
- 23andMe bankruptcy raised questions about genetic database sale as corporate asset
- Genetic data cannot be changed like passwords, making this breach permanently damaging
Timeline
23andMe confirms data breach affecting millions
Class action lawsuit filed against 23andMe
23andMe files for Chapter 11 bankruptcy
State AGs intervene to prevent genetic data sale in bankruptcy