DNA Diagnostics Center dnacenter.com

DNA Diagnostics Center data breach: what happened and what to do

An unauthorized party accessed an archived DNA Diagnostics Center database between May 24 and July 28, 2021. DDC announced it on November 29, 2021. Social Security numbers or payment information may have been exposed. News reports put the total at about 2.1 million people.

View all 13,177 breaches
Breach date
24 May 2021
Made public
29 Nov 2021
Affected
2,100,000
Data exposed
Social security numbers, Payment information
Last updated

Reviewed by Anthon Wansland

Head of Product & Co-Founder

Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.

What happened

DNA Diagnostics Center (DDC), a US genetic testing lab, announced on November 29, 2021 that an unauthorized party had accessed an archived database. DDC detected the possible access on August 6, 2021. Files and folders may have been taken from parts of the database between May 24 and July 28, 2021.

The database held personal information collected from 2004 to 2012. DDC said it came from a national genetic testing organization whose assets it bought in 2012. Later settlement documents say the data was transferred to DDC without the company knowing it was there.

Sources checked: oag.ca.gov, attorneygeneral.gov, scworld.com

Last verified against the official page:

How we research this Report an error

What was exposed

DDC said affected people may have had their Social Security numbers or payment information exposed. That matters more than it sounds, because a Social Security number doesn't change. Someone holding it can try to open credit, file a fake tax return or take out a loan in your name, and they can do it years from now. Payment details are the shorter-term risk: watch the statements for the card or account involved.

How many people

News coverage reports about 2.1 million people nationwide. The Pennsylvania Attorney General counted 12,663 Pennsylvanians whose Social Security numbers were exposed. Don't read a single state's number as the total.

What came after

In February 2023 the Pennsylvania and Ohio Attorneys General announced a $400,000 settlement with DDC, $200,000 for each state. It also requires annual security risk assessments and a named security coordinator. The Attorneys General said DDC did not use reasonable data security measures.

If you took a paternity or other DNA test with a US lab between 2004 and 2012 and got a letter from DDC, this is the breach it refers to.

What to do if you were in it

  1. 1

    Freeze your credit

    A Social Security number was in scope, so place a free credit freeze at Equifax, Experian and TransUnion. The FTC explains how.

  2. 2

    Check your credit reports

    Get your free reports at annualcreditreport.com and look for accounts you don't recognize.

  3. 3

    Watch the card or bank account you used

    If you paid DDC by card or bank transfer, read your statements and ask your bank or card issuer about replacing the card if anything looks off.

  4. 4

    Report misuse

    If someone uses your details, report it at IdentityTheft.gov to get a recovery plan.

  5. 5

    Check whether your email or phone is in this and other breaches

    Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your details show up in a new leak.

Official filings

Timeline

  1. The breach happened

  2. The company made it public

  3. Reported to the Washington Attorney General

Frequently asked

Was I affected by the DNA Diagnostics Center breach?

DDC mailed notices to the people whose information was in the archived database. If you used a US genetic testing lab between 2004 and 2012, check your mail and your email for a letter from DDC.

What was exposed?

DDC said Social Security numbers or payment information may have been exposed.

Is there a settlement?

Yes, with two states. In February 2023 DDC agreed to pay $400,000 to the Pennsylvania and Ohio Attorneys General. That settlement is with the states, not a payout to individuals.

Should I freeze my credit?

If you were told your Social Security number was involved, yes. A freeze is free, lasts until you lift it, and blocks most new accounts opened in your name.

Sources

Something wrong or out of date? Tell us and we'll re-check it.

Serus

Check if you're exposed in a breach with Serus

Find your leaks. Get alerted to new ones.

Run a free scan

Related guides

All guides
How to opt out of prescreened credit card offers (OptOutPrescreen) optoutprescreen.com Remove yourself from Equifax equifax.com Remove yourself from Experian experian.com Remove yourself from TransUnion transunion.com

Related articles

All articles

What is the dark web? Definition and how it works

What Happens If Your Email Is on the Dark Web – And What to Do Next

How to Get My Information Off the Dark Web

Cookie preferences

Choose which categories we may use. Full details for every cookie are in our Cookie Policy.

Strictly necessary

Authentication, session management, security and fraud prevention, and saving your consent choice. Always active. The site cannot function without them.

Functional

Remember preferences such as language and settings that improve your experience.

Analytics

Help us understand how the site is used, like pages visited, interactions, and performance, so we can improve it.

Marketing & advertising

Measure our marketing and deliver more relevant ads through partners such as Google, Meta, TikTok, X, and Reddit. Used only with your consent.

Your choice is saved for 12 months and applies across serus.ai, including the app. You can change it anytime from the cookie widget or the "Cookie settings" link in the footer. Withdrawing consent does not affect processing that happened before withdrawal.