Genetic testing company 23andMe has agreed to pay $18 million to settle claims from a coalition of 43 state attorneys general that it failed to protect customers genetic data. The settlement resolves allegations related to a data breach that occurred between April and September 2023, which compromised the personal information of approximately 6.9 million customers.
The breach was the result of credential-stuffing attacks, where attackers used usernames and passwords obtained from other security incidents to gain unauthorized access to 23andMe user accounts. Once inside, the attackers were able to access sensitive genetic ancestry information and other personal data stored on the platform.
The settlement requires 23andMe to implement several security improvements, including enhanced authentication measures, better monitoring for credential-stuffing attacks, and improved data protection practices. The company must also undergo regular security assessments and provide transparency about its data handling practices to consumers.
Genetic data is particularly sensitive because it can reveal information about an individual health risks, family relationships, and ethnic background. Unlike passwords or credit card numbers, genetic information cannot be changed once compromised, making the consequences of such breaches potentially permanent for affected individuals.
The 2023 breach served as a wake-up call for the direct-to-consumer genetic testing industry, highlighting the unique privacy risks associated with collecting and storing genomic data. Regulators and privacy advocates have since called for stronger protections for genetic information, including federal legislation that would establish minimum security standards for companies handling DNA data.
The $18 million settlement will be distributed among the participating states, with a portion dedicated to consumer protection efforts. 23andMe did not admit liability as part of the settlement but agreed to the financial payment and security improvements.
This article was adapted from Bleeping Computer. Read the original here.
