ENKR

23andMe credential stuffing and DNA Relatives data theft

Add to my breach check

Made public · 6,900,000 profiles

What leaked6

Hard to replace

  • Other profile data

Permanent

  • Health information
  • Ethnicity, religion or political views
  • Photos
  • Full name
  • Partial date of birth or age
  • Health informationhealth reports
  • Ethnicity, religion or political viewsrace and ethnicity
  • Photosprofile images
  • Full namedisplay name in DNA Relatives profiles
  • Other profile datafamily trees, self-reported city or postcode-level location
  • Partial date of birth or agebirth year

To-dos

None of the harms this check covers.

What happened next22 events

  1. Undetected 3 eventsabout 183 days · show events
  2. Response 8 eventsNo individual notice on record · show events
  3. Remedy 3 eventsEnded · Back to latest
  4. Penalty 2 eventsFine £2.3M · show events
  5. Disputes 6 eventsDismissed · show events

Remedy: 3 events

Back to latest
  1. Claims under the U.S. class settlementClosed
  2. Settlement administrator emailed eligible customers about the 50 million USD settlement: up to 10,000 USD for extraordinary claims, up to 165 USD for health information claims, an estimated 100 USD statutory payment, five years of monitoring
  3. Bar date for cyber security incident proofs of claim in the bankruptcyClosed
Company
23andMe
When it happened
Company detected it
Made public
Notice
Leak confirmed
Affected
6,900,000 profiles · approx.; about 14,000 accounts accessed directly, then about 5.5 million DNA Relatives and 1.4 million Family Tree profiles; 23andMe

Sources