ENKR

23andMe credential stuffing and DNA Relatives data theft

Add to my breach check

Made public · 6,900,000 profiles

What leaked6

Hard to replace

  • Other profile data

Permanent

  • Health information
  • Ethnicity, religion or political views
  • Photos
  • Full name
  • Partial date of birth or age
  • Health informationhealth reports
  • Ethnicity, religion or political viewsrace and ethnicity
  • Photosprofile images
  • Full namedisplay name in DNA Relatives profiles
  • Other profile datafamily trees, self-reported city or postcode-level location
  • Partial date of birth or agebirth year

To-dos

None of the harms this check covers.

What happened next22 events

  1. Undetected 3 eventsabout 183 days · show events
  2. Response 8 eventsNo individual notice on record · Back to latest
  3. Remedy 3 eventsEnded · show events
  4. Penalty 2 eventsFine £2.3M · show events
  5. Disputes 6 eventsDismissed · show events

Response: 8 events

Back to latest
  1. Sale of substantially all assets to TTAM Research Institute, a nonprofit affiliated with the co-founder, completed for 305 million USD
  2. The CEO resigned as an officer as the Chapter 11 cases were filed; a chief restructuring officer was appointed
  3. Filed for Chapter 11 in the Eastern District of Missouri to run a sale process; the company said it would use the proceedings to resolve legal liabilities from the October 2023 cyber incident
  4. Published the investigation results: about 14,000 accounts (0.1%) accessed; about 5.5 million DNA Relatives and 1.4 million Family Tree profiles reached through them
  5. Form 8-K/A with the investigation results; expected one-time costs of 1 to 2 million USD
3 more
  1. Temporarily disabled some DNA Relatives features
  2. Required all users to reset their passwords; two-step verification mandatory from November 6, 2023
  3. Blog post: profile information was compiled from accounts through credential stuffing
Company
23andMe
When it happened
Company detected it
Made public
Notice
Leak confirmed
Affected
6,900,000 profiles · approx.; about 14,000 accounts accessed directly, then about 5.5 million DNA Relatives and 1.4 million Family Tree profiles; 23andMe

Sources