23andMe

Disclosed Oct 6, 20236,900,000 affectedSettled

Credential stuffing exposed 6.9M users' ancestry data; UK ICO fine of GBP 2.31M

Between April and September 2023 a hacker used credentials reused from other breaches to access 23andMe accounts, exposing data on about 6.9 million users, including 155,592 UK residents. The ICO fined 23andMe GBP 2.31M, noting it lacked extra verification before raw genetic data downloads.

What is known

People affected	6,900,000 (as reported by the organization)
Disclosed	Oct 6, 2023
Discovered	Oct 2023
Happened	Apr 29, 2023
Attack	Credential stuffing
Data exposed	NamesDates of birthLocationHealthOther
Sector	Healthcare · US
Status	Settled
Lawsuit or fine	GBP 2.31M ICO fine (June 2025); USD 18M 43-AG settlement (July 2026) (about $21M) On Lawsuits

Sources

Official noticeoag.ca.gov

California Attorney General breach notice: 23andMe

Regulatorico.org.uk

23andMe fined GBP 2.31 million for failing to protect UK users' genetic data

Newstechcrunch.com

23andMe confirms hackers stole ancestry data on 6.9 million users

Newstheverge.com

23andMe agrees to pay $30 million to settle lawsuit over massive data breach

Regulatorag.ny.gov

NY AG: USD 18 Million from 23andMe

Newsen.wikipedia.org

23andMe data leak (Wikipedia)

Regulatorico.org.uk

ICO: 23andMe

Newstechcrunch.com

UK watchdog fines 23andMe over 2023 data breach

fru.devlawsuits.fru.dev

Lawsuits: In re 23andMe Customer Data Security Breach Litigation

Notices filed

TotalOct 6, 2023

Research6,900,000 people

TotalOct 6, 2023

Research6,900,000 people

Residents of CAJan 21, 2024

California AGCount not stated

History of this record

lawsuits_ref2026-09-25

empty to in-re-23andme-breach-mdlby weeklySource

fine_usd2026-09-25

30000000 to 21100000by seedSource

lawsuit2026-09-25

$30M US class action settlement (2024); UK ICO fine of GBP 2.31M (2025) to GBP 2.31M ICO fine (June 2025); USD 18M 43-AG settlement (July 2026)by seedSource

summary2026-09-25

Attackers reused passwords from other breaches to log in to 23andMe accounts between April and September 2023 and scraped profile and ancestry data shared through the DNA Relatives feature. The company later said about 6.9 million people we to Between April and September 2023 a hacker used credentials reused from other breaches to access 23andMe accounts, exposing data on about 6.9 million users, including 155,592 UK residents. The ICO fined 23andMe GBP 2.31M, noting it lacked exby seedSource

title2026-09-25

Credential stuffing exposes DNA Relatives profiles of 6.9 million users to Credential stuffing exposed 6.9M users' ancestry data; UK ICO fine of GBP 2.31Mby seedSource

status2026-09-25

confirmed to settledby seedSource

fine_usd2026-09-25

empty to 30000000by seedSource

lawsuit2026-09-25

empty to $30M US class action settlement (2024); UK ICO fine of GBP 2.31M (2025)by seedSource

sector2026-09-25

other to healthby seedSource

attack2026-09-25

unknown to credential-stuffingby seedSource

data_types2026-09-25

[] to ["names","dob","location","health","other"]by seedSource

records_basis2026-09-25

empty to organizationby seedSource

records2026-09-25

empty to 6900000by seedSource

disclosed2026-09-25

2024-01-21 to 2023-10-06by seedSource

discovered2026-09-25

empty to 2023-10by seedSource

summary2026-09-25

empty to Attackers reused passwords from other breaches to log in to 23andMe accounts between April and September 2023 and scraped profile and ancestry data shared through the DNA Relatives feature. The company later said about 6.9 million people weby seedSource

title2026-09-25

empty to Credential stuffing exposes DNA Relatives profiles of 6.9 million usersby seedSource

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.

Everything about 23andMe