23andMe Genetic Data Breach: DNA Profiles and Ancestry Data Stolen

23andMe disclosed a data breach affecting approximately 6.9 million users after attackers used credential stuffing to access accounts and then exploited the DNA Relatives feature to scrape genetic and ancestry data of connected profiles. The stolen data included genetic ancestry results, birth years, geographic locations, family names, and profile pictures. The breach was particularly alarming because genetic data is immutable; unlike passwords or credit card numbers, individuals cannot change their DNA. Stolen genetic profiles could theoretically be used for discrimination, insurance denial, or targeting of ethnic groups. 23andMe faced class-action lawsuits and criticism for initially downplaying the breach and blaming users for password reuse rather than acknowledging the platform design flaw that allowed one compromised account to access thousands of connected profiles. The company later filed for bankruptcy, raising concerns about the fate of millions of genetic profiles held by a company with no clear future.

The ramifications of this incident extend beyond the immediate data exposure. Privacy regulators in multiple jurisdictions have opened investigations, and affected individuals are organizing collective action to demand accountability and meaningful remediation. The case highlights systemic weaknesses in how organizations handle personal data and the gap between corporate privacy promises and operational reality.

For impacted individuals, immediate action is critical. Filing a data subject access request forces the company to disclose exactly what data they hold about you, providing the foundation for deletion requests, regulatory complaints, and potential legal action. Below, we outline the specific data types at risk and the concrete steps you can take to protect yourself.