A California lawsuit claims that 23andMe failed to protect sensitive DNA data before a major 2023 breach. Here’s what happened, what information was accessed, and why it matters to you.
Table of Contents
What Happened?
The lawsuit focuses on a 2023 data breach that affected nearly seven million 23andMe users.
Bonta said 23andMe failed to properly protect customer information and misled users about how serious the breach was.
The company has not publicly responded to the lawsuit.
The case follows years of regulatory scrutiny, including a £2.31 million fine from the UK’s Information Commissioner’s Office in 2025.
fWho Was Affected and What Data Was Accessed?
The breach affected nearly seven million people who used 23andMe to learn about their ancestry, family history, and genetic health information.
Investigators say attackers accessed highly sensitive information, including:
- Genetic predispositions (health-related genetic traits)
- Disease risk information
- Ancestry details
- Ethnicity information
- Information about biological relatives
Authorities also said some of the stolen records were marketed as containing information linked to users with Jewish and Asian American Pacific Islander ancestry.
Information connected to your health, family history, and ancestry can be especially sensitive. Criminals may use personal details to create more convincing phishing emails, impersonation attempts, or identity theft schemes.
The risk can be even greater when this information is combined with other personal data leaked in other incidents.
Many people do not realize their information may already be circulating online.
If you are not sure whether your data was leaked online, automatic monitoring can help you spot problems earlier.
Futureproof monitors your email 24/7 for data leaks and gives clear steps to secure your account from scams.
How Did the Attack Happen?
Investigators say attackers used a credential stuffing attack (a method where criminals use passwords stolen from older breaches to try logging into other accounts).
These attacks work because many people reuse passwords. Studies show that roughly 60% to 65% of people use the same password across multiple accounts.
If a password was leaked elsewhere, attackers can test it against other services and sometimes gain access.
Regulators in both the UK and Canada later found that 23andMe lacked stronger login protections that could have helped stop these attacks.
Futureproof scans your data for leaks and shows exactly how to close security gaps — before scammers find them first.
Check my safetyWhy Your DNA Data Deserves Extra Protection
Most data breaches involve names, email addresses, or passwords. Genetic information is different because it cannot be changed like a password.
DNA data can reveal family connections, ancestry, and health-related information. Once that information is accessed, it may remain available for a very long time.
A single breach can create risks long after the original incident is forgotten.
This case is a reminder that sensitive information deserves stronger protection, especially when it relates to health, identity, and family relationships.
3 Simple Ways to Better Protect Your Data
To better protect your personal information, follow these simple steps:
1. Secure your email account
Your email connects to many of your online accounts. If someone gains access to it, they may be able to reset passwords elsewhere.
Use a strong password and turn on two-step verification (an extra security step that requires a second code).
If you are not sure how to strengthen your account security, the Futureproof Email Protection tool can help. With Email Protection, you can create strong passwords and set up two-step verification to secure your account faster.
2. Watch for messages that use personal details
Be cautious if an email, text, or caller mentions information about your family, health history, or other personal details.
Criminals often use stolen information to make fake messages seem trustworthy. If a message asks for money, passwords, or personal information, contact the organization directly using its official website before responding.
3. Remove accounts you no longer use
Old accounts often contain personal information that people forget about.
Search your email for “Welcome” or “Verify your account“, “Sign up,” or “Registration” messages to find old accounts you no longer use. Then close any accounts you no longer need. Fewer accounts mean fewer places where your information can be stored or stolen.
A Data Breach Can Affect More Than Your Passwords
The 23andMe breach shows that sensitive information goes beyond passwords and credit card numbers. Data such as your DNA profile, ancestry details, and family connections can remain valuable to criminals long after a breach occurs.
You cannot prevent every company from being targeted by cybercriminals. However, using unique passwords, enabling two-step verification, and deleting accounts you no longer use can help reduce your risk.
Staying informed and checking for signs of data misuse can help you spot problems earlier and provide greater peace of mind.
At Futureproof, Kevin explains digital safety in simple words, with clear tips and zero fluff. He holds a degree in information technology and studies fraud trends to keep his tips up-to-date.
In his free time, Kevin plays with his cat, enjoys board-game nights, and hunts for New York’s best cinnamon rolls.
