ENKR

23andMe credential stuffing and DNA Relatives data theft

Add to my breach check

Made public · 6,900,000 profiles

What leaked6

Hard to replace

  • Other profile data

Permanent

  • Health information
  • Ethnicity, religion or political views
  • Photos
  • Full name
  • Partial date of birth or age
  • Health informationhealth reports
  • Ethnicity, religion or political viewsrace and ethnicity
  • Photosprofile images
  • Full namedisplay name in DNA Relatives profiles
  • Other profile datafamily trees, self-reported city or postcode-level location
  • Partial date of birth or agebirth year

To-dos

None of the harms this check covers.

What happened next22 events

  1. Undetected 3 eventsabout 183 days · show events
  2. Response 8 eventsNo individual notice on record · show events
  3. Remedy 3 eventsEnded · show events
  4. Penalty 2 eventsFine £2.3M · Back to latest
  5. Disputes 6 eventsDismissed · show events

Penalty: 2 events

Back to latest
  1. ICO fined 23andMe 2.31 million GBP after a joint investigation with the Office of the Privacy Commissioner of Canada; 155,592 UK residents affected
  2. California's Department of Justice opened an investigation after reports of the breach
Company
23andMe
When it happened
Company detected it
Made public
Notice
Leak confirmed
Affected
6,900,000 profiles · approx.; about 14,000 accounts accessed directly, then about 5.5 million DNA Relatives and 1.4 million Family Tree profiles; 23andMe

Sources