23andMe Data Breach

In October 2023, attackers used credential stuffing to access information linked to about 6.

9 million 23andMe customers, including ancestry and other genetic data in some cases. The incident prompted investigations into the company’s security practices, an $18 million settlement involving 42 state attorneys general, and a separate consumer class-action settlement in bankruptcy proceedings. After 23andMe filed for bankruptcy in 2025, its consumer-data assets were transferred to TTAM Research Institute under requirements covering security, privacy compliance, oversight, and customer deletion rights. The episode continues to shape questions about the protection and future use of genetic information.