Now Hacked
EN
Data breach

23andMe Breach Leaks Genetic and Personal Data of 6.9 Million Users

First reported · Last reported · 99 related reports

In 2023, a credential stuffing attack on 23andMe leaked the ancestry and personal data of about 6.9 million users, and some health information and raw genotype data were also stolen. The attack went undetected for months. Lawsuits and settlements with victims and state governments followed, and in October 2026 the settlements with victims and states were reported to total $70 million.

Key facts

Affected organization
23andMe
Incident type
Data breach
Occurred / detected
Not confirmed
Scale of damage
Ancestry and personal data of about 6.9 million users, and some health and genotype data
Cause / method
Credential stuffing attack
Location
United States

If your data was exposed

Exposed dataHealth & medical data

  1. Don’t tap links in texts, calls or emails that mention this incident and offer compensation, refunds or breach checks. Check directly on the organization’s official website or app.

Timeline

  1. 23andMe confirmed the leak of about 6.9 million users' information.
  2. It became known that raw genotype data was also stolen and that the attack went undetected for months.
  3. 23andMe agreed to a $30 million settlement over the data breach.
  4. California had previously sued 23andMe over the 2023 leak of ancestry and genetic information.
  5. 23andMe reached an $18 million settlement with state governments over the large-scale data breach.
  6. The settlements with victims and state governments were reported to total $70 million.

99 related reports

The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organization’s official statements for accurate details.