23andMe to Shell Out $30 Million in Astonishing Genetics Data Breach Settlement

Imagine receiving a package in the mail containing a small tube that holds the key to uncovering your ancestry, traits, and health predispositions. You trust the company to keep your most sensitive information, your DNA, safe and secure. But what happens when that trust is broken? In 2023, 23andMe, a leading DNA testing company, faced this very issue when a massive data breach exposed the personal information of 6.4 million customers.

Fast forward to today, and 23andMe has agreed to pay a whopping $30 million to settle a lawsuit resulting from the breach. The proposed class action settlement is currently awaiting judicial approval and includes cash payments for affected customers. While the company believes the settlement is fair, they also deny any wrongdoing and maintain that they properly protected their customers’ personal information.

Addressing Security Weaknesses

In addition to the financial settlement, 23andMe has agreed to strengthen its security protocols, such as adding protections against credential-stuffing attacks and requiring mandatory two-factor authentication for all users. The company also plans to conduct annual cybersecurity audits and create a comprehensive data breach incident response plan.

Furthermore, 23andMe will no longer retain personal data for inactive or deactivated accounts and will provide an updated Information Security Program to employees during annual training sessions. While these actions may help rebuild trust, it’s important for us to recognize that data breaches can happen to anyone – even trusted companies like 23andMe.

Understanding the Data Breach

So, how did the breach occur? In October 2023, 23andMe discovered unauthorized access to customer profiles resulting from compromised accounts. Hackers exploited credentials stolen from other breaches to access 23andMe accounts. In response, the company implemented measures to block similar incidents, such as requiring customers to reset passwords and enabling two-factor authentication by default.

However, the damage was already done. Starting in October, threat actors leaked data profiles belonging to 4.1 million individuals in the United Kingdom and 1 million Ashkenazi Jews on the unofficial 23andMe subreddit and hacking forums. In total, data for 6.9 million customers, including information on 6.4 million U.S. residents, was downloaded in the breach.

Moreover, the company confirmed that attackers stole health reports and raw genotype data during a five-month credential-stuffing attack that took place from April to September. As a result, multiple class-action lawsuits were filed against 23andMe, leading to the recent settlement.

A Call to Action for Cybersecurity Awareness

As we reflect on the 23andMe data breach, it’s crucial to recognize that we all play a role in safeguarding our personal information. By staying informed about cybersecurity best practices and understanding the risks involved in sharing sensitive data, we can better protect ourselves from potential threats.

At IT Services, we’re committed to helping you stay informed and secure. Keep coming back to learn more about cybersecurity, and don’t hesitate to contact us with any questions or concerns. Together, we can build a safer digital world for all.