ENKR

23andMe credential stuffing and DNA Relatives data theft

Add to my breach check

Made public · 6,900,000 profiles

What leaked6

Hard to replace

  • Other profile data

Permanent

  • Health information
  • Ethnicity, religion or political views
  • Photos
  • Full name
  • Partial date of birth or age
  • Health informationhealth reports
  • Ethnicity, religion or political viewsrace and ethnicity
  • Photosprofile images
  • Full namedisplay name in DNA Relatives profiles
  • Other profile datafamily trees, self-reported city or postcode-level location
  • Partial date of birth or agebirth year

To-dos

None of the harms this check covers.

What happened next22 events

  1. Undetected 3 eventsabout 183 days · show events
  2. Response 8 eventsNo individual notice on record · show events
  3. Remedy 3 eventsEnded · show events
  4. Penalty 2 eventsFine £2.3M · show events
  5. Disputes 6 eventsDismissed · Back to latest

Disputes: 6 events

Back to latest
  1. Settlement of USD 6 million with the California Attorney General over the 2023 breach, filed in the bankruptcy court and pending its approval
  2. MDL closed on a stipulated dismissal with prejudice
  3. Bankruptcy court approved the U.S. data breach class settlement, subject to an opt-out period for members notified late
  4. Settlements with state-court plaintiffs and arbitration claimants; as of March 2025, the total agreed for U.S. customer claims was 37.5 million USD
  5. Motion for preliminary approval of the class settlement conditionally granted
  6. Federal class actions consolidated as MDL No. 3098 in the Northern District of California
Company
23andMe
When it happened
Company detected it
Made public
Notice
Leak confirmed
Affected
6,900,000 profiles · approx.; about 14,000 accounts accessed directly, then about 5.5 million DNA Relatives and 1.4 million Family Tree profiles; 23andMe

Sources