23andMe 23andme.com 23andMe data breach: what happened and what to do
From April to September 2023 an attacker used passwords reused from other sites to log in to 23andMe accounts, then pulled data on millions of people through the DNA Relatives feature. Reports put the total at about 6.9 million people. The UK ICO fined 23andMe £2.31 million.
View all 13,115 breaches- Breach date
- Apr 2023
- Affected
- 6,900,000
- Data exposed
- Names, Dates of birth, Physical addresses, Ethnicities, Family trees, Health reports
- Last updated
23andMe's 2023 breach is one of the clearest examples of how one reused password can expose people who did nothing wrong. Attackers got into a relatively small number of accounts, then used 23andMe's family-matching features to collect data on millions more.
What happened
According to the UK Information Commissioner's Office (ICO), an attacker used login credentials stolen from earlier, unrelated breaches to get into 23andMe accounts between April and September 2023. This is credential stuffing: trying leaked email and password pairs on another service. 23andMe did not require multi-factor authentication at the time. The ICO found that the company lacked measures such as mandatory multi-factor authentication, secure password protocols and unpredictable usernames.
Reports say about 14,000 accounts were accessed directly. The exposure reached far more people because of DNA Relatives, a feature that lets matched relatives see each other's shared information. Press reports put the total at about 6.9 million people, although the exact figure varies by source and by how it is counted. The ICO said 155,592 UK residents had data accessed.
The ICO also reported that 23andMe didn't start a full investigation until October 2023, after a staff member found the stolen data offered for sale online. Some of the data was later sold and leaked.
What was exposed
What an attacker saw depended on each person's sharing settings. According to the ICO and press reports, the data could include:
- Names and birth years
- Self-reported location, at city or postcode level
- Profile images
- Race and ethnicity
- Family tree information
- Health reports
Raw genetic data is a different matter, and the ICO said 23andMe did not have extra verification before users could access and download it.
Why genetic data is a different kind of breach
You can change a password. You can't change your DNA, or your family's. Relatives who never used 23andMe can be identified through the people who did. Ancestry and ethnicity details can also be used to target people with scams or harassment. Because the data doesn't expire, the risk is long-term.
The regulator's response and the company
In June 2025 the ICO fined 23andMe £2.31 million for failing to protect UK users' genetic data, following a joint investigation with Canada's privacy regulator. In March 2025 regulators had proposed a larger fine of £4.59 million. 23andMe filed for Chapter 11 bankruptcy in March 2025 and its assets were later sold.
What to do now
Reset your 23andMe password if you still have an account, and turn on two-factor authentication. If you want your account closed, use the delete option in your account settings. Be careful with any message about your DNA results, ancestry or "relatives": scammers use real details to sound legitimate.
What to do if you were in it
- 1
Change your 23andMe password and turn on 2FA
Use a unique password. Change it on any other account that shared the same one, starting with your email.
- 2
Review your sharing settings
In your 23andMe account, check who can see your profile, ancestry and DNA Relatives matches. Turn off sharing you don't need.
- 3
Think about deleting your account and data
Account settings let you delete your account. Deleting doesn't recall what was already taken, but it limits what else is held.
- 4
Expect scams that use real family and ancestry details
Messages claiming to be from 23andMe, a lawyer or a 'relative' may quote your name, location or ethnicity. Don't click links or pay anything.
- 5
Watch your credit and accounts
Genetic details alone don't open a bank account, but names, birth years and locations help fraud. A free credit freeze at Equifax, Experian and TransUnion costs nothing.
- 6
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see which breaches include your email address or phone number. Serus monitors breach databases and the dark web and alerts you when your data appears, so you hear about the next one early.
Frequently asked
How many people were affected by the 23andMe breach?
Reports put the total at about 6.9 million people. The ICO said data on 155,592 UK residents was accessed. Exact numbers vary by source.
What was exposed?
Depending on each person's settings: names, birth years, location, profile images, race and ethnicity, family tree information and health reports.
Was 23andMe hacked?
The ICO says an attacker used passwords stolen in unrelated breaches to log in to accounts. 23andMe did not require multi-factor authentication at the time.
Was 23andMe fined?
Yes. The UK ICO fined 23andMe £2.31 million in June 2025.
Sources
- ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/06/23andme-fined-for-failing-to-protect-uk-users-genetic-data/
- ico.org.uk/action-weve-taken/enforcement/2025/06/23andme/
- techcrunch.com/2025/06/17/uk-watchdog-fines-23andme-over-2023-data-breach
- en.wikipedia.org/wiki/23andMe_data_leak
- oag.ca.gov/privacy/databreach/list
Something wrong or out of date? Tell us and we'll re-check it.
