23andMe 23andme.com 23andMe data breach: what happened and what to do
In October 2023, attackers used passwords reused from other sites to get into about 14,000 23andMe accounts. Through the DNA Relatives feature they could see profile information of about 6.9 million people. 23andMe said its own systems were not breached.
View all 13,177 breaches- Breach date
- Oct 2023
- Affected
- 6,900,000
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
In October 2023, 23andMe said attackers had gained access to some customer accounts. The company said they used credential stuffing: trying email and password pairs that had already leaked from other websites. About 14,000 accounts, roughly 0.1% of users, fell to this, according to reporting by HIPAA Journal and NBC News.
Sources checked: nbcnews.com, hipaajournal.com, healthitsecurity.com
Last verified against the official page:
Why 6.9 million people were affected
Those 14,000 accounts opened a door to many more. The attackers used the DNA Relatives feature, which shows matches between users who opt in, to see profile information of about 6.9 million people. That is close to half of the roughly 14 million people who had joined the feature. Someone who never had their own account compromised could still be in the exposed group.
The company's response
23andMe said its own systems were not breached and that the accounts were reached because people had reused a password on another site and had no two-factor login. It required two-factor authentication for all users and asked everyone to reset their password. A lawyer for plaintiffs argued that only a few thousand accounts were compromised directly, so the company's explanation shifted the blame to customers.
What this means for you
Genetic and family-tree details can't be changed the way a password can. The practical risks are targeted phishing that mentions your ancestry or relatives, and account takeover if you reuse passwords anywhere.
What to do if you were in it
- 1
Change your 23andMe password and any you reused
Pick a unique password for 23andMe and for every account that shared it. A password manager makes that practical.
- 2
Turn on two-factor login
Use an authenticator app or passkey on 23andMe and on your email account.
- 3
Review your DNA Relatives settings
Check what profile information is shared with matches and turn off sharing you don't want.
- 4
Expect phishing that mentions DNA or family
Don't click links in messages about your results or relatives. Go to the company's site yourself. If you lose money or details, report it at IdentityTheft.gov.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your details appear.
Official filings
- California Attorney General , filed 21 Jan 2024
Timeline
-
The breach happened
-
Reported to the California Attorney General
Frequently asked
Was I affected by the 23andMe breach?
If you used the DNA Relatives feature in 2023, your profile information may have been visible to the attackers. 23andMe said about 6.9 million people were affected.
How did the attackers get in?
23andMe said they used passwords reused from other breached sites on about 14,000 accounts, and that its own systems were not breached.
Should I change my password?
Yes, if you reused it anywhere. Use a unique password and turn on two-factor login.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
