ENKR

23andMe credential stuffing and DNA Relatives data theft

Add to my breach check

Made public · 6,900,000 profiles

What leaked6

Hard to replace

  • Other profile data

Permanent

  • Health information
  • Ethnicity, religion or political views
  • Photos
  • Full name
  • Partial date of birth or age
  • Health informationhealth reports
  • Ethnicity, religion or political viewsrace and ethnicity
  • Photosprofile images
  • Full namedisplay name in DNA Relatives profiles
  • Other profile datafamily trees, self-reported city or postcode-level location
  • Partial date of birth or agebirth year

To-dos

None of the harms this check covers.

What happened next22 events

  1. Undetected 3 eventsabout 183 days · show events
  2. Response 8 eventsNo individual notice on record · show events
  3. Remedy 3 eventsEnded · show events
  4. Penalty 2 eventsFine £2.3M · show events
  5. Disputes 6 eventsDismissed · show events
  1. Settlement of USD 6 million with the California Attorney General over the 2023 breach, filed in the bankruptcy court and pending its approval
  2. MDL closed on a stipulated dismissal with prejudice
  3. Claims under the U.S. class settlementClosed
  4. Settlement administrator emailed eligible customers about the 50 million USD settlement: up to 10,000 USD for extraordinary claims, up to 165 USD for health information claims, an estimated 100 USD statutory payment, five years of monitoring
  5. Bankruptcy court approved the U.S. data breach class settlement, subject to an opt-out period for members notified late
17 more
  1. Sale of substantially all assets to TTAM Research Institute, a nonprofit affiliated with the co-founder, completed for 305 million USD
  2. Bar date for cyber security incident proofs of claim in the bankruptcyClosed
  3. ICO fined 23andMe 2.31 million GBP after a joint investigation with the Office of the Privacy Commissioner of Canada; 155,592 UK residents affected
  4. The CEO resigned as an officer as the Chapter 11 cases were filed; a chief restructuring officer was appointed
  5. Filed for Chapter 11 in the Eastern District of Missouri to run a sale process; the company said it would use the proceedings to resolve legal liabilities from the October 2023 cyber incident
  6. Settlements with state-court plaintiffs and arbitration claimants; as of March 2025, the total agreed for U.S. customer claims was 37.5 million USD
  7. Motion for preliminary approval of the class settlement conditionally granted
  8. Federal class actions consolidated as MDL No. 3098 in the Northern District of California
  9. Published the investigation results: about 14,000 accounts (0.1%) accessed; about 5.5 million DNA Relatives and 1.4 million Family Tree profiles reached through them
  10. Form 8-K/A with the investigation results; expected one-time costs of 1 to 2 million USD
  11. Temporarily disabled some DNA Relatives features
  12. Required all users to reset their passwords; two-step verification mandatory from November 6, 2023
  13. Blog post: profile information was compiled from accounts through credential stuffing
  14. The attacker posted files of DNA Relatives profile information online
  15. A threat actor posted online a claim to have users' profile information; 23andMe began an investigation
  16. Intrusion began
  17. California's Department of Justice opened an investigation after reports of the breach
Company
23andMe
When it happened
Company detected it
Made public
Notice
Leak confirmed
Affected
6,900,000 profiles · approx.; about 14,000 accounts accessed directly, then about 5.5 million DNA Relatives and 1.4 million Family Tree profiles; 23andMe

Sources