Summary
23andMe held the most personal data there is: people's DNA. In 2023 attackers got into more than 18,000 accounts and, through a single social feature, turned that into the genetic and ancestry data of roughly 6.9 million people. The break-in required no flaw in 23andMe at all. Attackers simply took username-and-password pairs leaked from other companies' breaches and tried them, betting, correctly, that people reuse passwords. The accounts had no MFA, and 23andMe did not notice the five-month wave of automated logins. From those footholds, the attackers scraped relatives' data through an opt-in feature, and the fallout, fines, a $50 million settlement, and ultimately bankruptcy and a fire-sale of the DNA database itself, shows that a breach can be fatal even when your own systems were never hacked.
How it happened
This was a credential-stuffing campaign that ran from late April to September 2023, undetected for about five months. The attacker took username and password pairs leaked from unrelated prior breaches and tried them, by the million, against 23andMe's login. Because so many people reuse passwords, more than 18,000 accounts were directly compromised (23andMe's first, US-focused disclosure put it near 14,000; the later joint UK-Canada regulatory investigation established the global figure at 18,222). 23andMe's own systems were never breached, but it failed to detect or throttle the flood, even when one account was hit with around a million login attempts in a single day, and it did not enforce MFA, with only about 22% of users having it enabled.
Then came the amplifier. From those footholds, the attacker abused the opt-in DNA Relatives and Family Tree features, which are designed to show you information about your genetic relatives, to scrape data on approximately 6.9 million additional people (around 5.5 million through DNA Relatives and 1.4 million through Family Tree), including names and ancestry estimates. Curated lists, for example of people with Ashkenazi Jewish or Chinese ancestry, were advertised for sale, a genuinely chilling targeting risk. One feature meant for family discovery turned 18,000 break-ins into a millions-strong data leak.
The damage
Around 6.9 million people had genetic-relative data exposed, none of whom were among the directly compromised accounts. The ethnicity-targeted lists raised real safety fears. The corporate fallout was severe and lasting: the UK's data regulator fined the company £2.31 million in 2025 for failing to protect genetic (special-category) data, a US class action settled for $50 million (approved in early 2026), and in March 2025 the company filed for Chapter 11 bankruptcy. The data outlived the company: after a contested auction, 23andMe's assets, including its vast DNA database, were bought for $305 million by TTAM, a nonprofit founded by co-founder Anne Wojcicki, a uniquely modern lesson in what happens to your genome when a genomics company fails. The whole catastrophe originated in password reuse and a permissive sharing feature, not in any hack of 23andMe itself.
Why 23andMe still matters
23andMe is the lesson that you can be breached without being hacked. When your users reuse passwords, you do not enforce MFA, and you do not detect a login flood, attackers walk in through the front door using credentials you never held. And a feature that exposes data about other people means a few thousand accounts can leak millions of records. The data here, DNA and ancestry, is uniquely permanent and sensitive, and unlike a password it can never be reset. The defences: enforce MFA, which would have stopped the takeovers cold; detect and throttle credential stuffing and check passwords against known-breached corpora; design data-sharing features so one account cannot bulk-scrape millions of others (rate limits, minimised exposure); and minimise and protect uniquely sensitive data. The reused passwords that fuelled it trace back to mega-breaches like Yahoo.
How to fix it
- Force password resets, enforce MFA, and invalidate sessions; a reset is the only way to evict reused-credential access.
- Throttle and block the credential-stuffing traffic, and check user passwords against known-breached-password corpora.
- Rate-limit and constrain the data-sharing features so a single account cannot scrape millions of others' records.
How to avoid it
- Enforce MFA so a reused or stolen password is not enough on its own; it would have stopped this entirely.
- Detect and throttle credential stuffing, and reject passwords known from prior breaches at sign-up and login.
- Design social and data-sharing features so one compromised account cannot bulk-scrape data about other people.
- Minimize and strongly protect uniquely sensitive data (genetic, biometric), and limit how much relatives' data any feature exposes.
- Monitor for spikes in failed and unusual logins, the signature of an automated credential-stuffing run.
References
- https://www.priv.gc.ca/en/opc-actions-and-decisions/investigations/investigations-into-businesses/2025/pipeda-2025-001/
- https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/06/23andme-fined-for-failing-to-protect-uk-users-genetic-data/
- https://www.23andmedatasettlement.com/
- https://oag.ca.gov/news/press-releases/attorney-general-bonta-sues-chrome-holding-co-formerly-known-23andme-over-2023
- https://blog.23andme.com/articles/addressing-data-security-concerns
Related vulnerabilities
All OpSec →- CRITICALOPSEC-MIDNIGHT-BLIZZARD-2024
In January 2024, Microsoft revealed that Russia's foreign-intelligence service, the same APT29 behind SolarWinds, had been reading the email of its senior leadership. The way in was almost insulting in its simplicity: a forgotten, non-production test account with a weak password and no MFA. The attackers guessed the password by spraying common ones across many accounts, then pivoted through a forgotten over-privileged application to grant themselves access to corporate mailboxes, including those of executives and the security and legal teams. It is the lesson that your security is only as strong as the account you forgot about, and that even Microsoft's perimeter fell to a missing MFA checkbox.
- HIGHOPSEC-INTERNET-ARCHIVE-2024
The Internet Archive, the nonprofit behind the Wayback Machine, had a brutal October 2024: a data breach, a website defacement, and a wave of DDoS attacks, all at once. Underneath the chaos was an unglamorous root cause. An authentication token sat in plain text in a public config file; the team rotated it repeatedly, but each new token landed right back in the same exposed file, so the leak never actually closed. With it, an attacker downloaded the source code, found more credentials hardcoded inside, and walked out with a database of 31 million users. Weeks later a second token from that same stolen code, for the support system, exposed 800,000 support tickets, some with people's ID documents. It is the lesson that rotating a secret is useless if it goes straight back into a public file, and that one leak unravels everything.
- CRITICALOPSEC-SNOWFLAKE-2024
In mid-2024, a single gap, accounts without multi-factor authentication, turned into one of the largest waves of data theft ever, hitting Ticketmaster, AT&T, Santander, and around 165 other companies at once. The attackers never broke Snowflake, the cloud data platform all of them used. They simply logged in with valid usernames and passwords, harvested months or years earlier by infostealer malware from employees' personal computers and bought on criminal markets. Where MFA was not turned on, a stolen password was a full key. It is the defining lesson of the infostealer era: your breach can start on an employee's home laptop, and MFA is the difference between a leaked password and a catastrophe.
- HIGHOPSEC-MERCEDES-BENZ-2024
Publicly disclosed January 30, 2024, a Mercedes-Benz employee accidentally committed a GitHub authentication token to a public repository, leaving it exposed from September 29, 2023. RedHunt Labs found the token during an internet-wide scan; it granted unrestricted, unmonitored access to Mercedes-Benz's internal GitHub Enterprise Server, allowing anyone to download private source-code repositories that could contain API keys, cloud access keys, database connection strings, blueprints, and SSO passwords. After notification, the token was revoked on January 24, 2024. Mercedes-Benz stated customer data was not affected but could not confirm whether anyone besides the researchers accessed the repositories during the exposure window.
- HIGHOPSEC-OKTA-2023
Okta is an identity provider: the single front door thousands of companies use to log their employees into everything. So when Okta's customer-support system was breached in late 2023, the blast radius was a who's-who of security-conscious companies. The entry point was almost mundane. An employee had signed into their personal Google account on an Okta laptop and saved a corporate service-account password into it; the attacker got that password and walked into Okta's support system. There they downloaded diagnostic files that customers had uploaded, some of which contained live session tokens, and used those tokens to step directly into the customers' own Okta environments. It is the lesson that session tokens are as good as passwords, support systems are production systems, and a personal browser profile can be the crack in the wall.
- HIGHOPSEC-MICROSOFT-SAS-2023
Microsoft's AI research team shared open-source training data via an Azure Storage Shared Access Signature (SAS) token committed to a public GitHub repo around July 2020. The token was misconfigured to scope access to the entire storage account with full-control permissions instead of the intended read-only bucket, so anyone with the link could view, delete, and overwrite files. Wiz researchers discovered it in June 2023, finding 38 terabytes of exposed internal data including two employees' workstation disk backups with secrets, private keys, passwords, and over 30,000 internal Teams messages. Writable pickle-format models created a model-poisoning supply-chain risk; Microsoft revoked the token and reported no customer data was exposed.