ENKR

23andMe credential stuffing and DNA Relatives data theft

Add to my breach check

Made public · 6,900,000 profiles

What leaked6

Hard to replace

  • Other profile data

Permanent

  • Health information
  • Ethnicity, religion or political views
  • Photos
  • Full name
  • Partial date of birth or age
  • Health informationhealth reports
  • Ethnicity, religion or political viewsrace and ethnicity
  • Photosprofile images
  • Full namedisplay name in DNA Relatives profiles
  • Other profile datafamily trees, self-reported city or postcode-level location
  • Partial date of birth or agebirth year

To-dos

None of the harms this check covers.

What happened next22 events

  1. Undetected 3 eventsabout 183 days · Back to latest
  2. Response 8 eventsNo individual notice on record · show events
  3. Remedy 3 eventsEnded · show events
  4. Penalty 2 eventsFine £2.3M · show events
  5. Disputes 6 eventsDismissed · show events

Undetected: 3 events

Back to latest
  1. The attacker posted files of DNA Relatives profile information online
  2. A threat actor posted online a claim to have users' profile information; 23andMe began an investigation
  3. Intrusion began
Company
23andMe
When it happened
Company detected it
Made public
Notice
Leak confirmed
Affected
6,900,000 profiles · approx.; about 14,000 accounts accessed directly, then about 5.5 million DNA Relatives and 1.4 million Family Tree profiles; 23andMe

Sources