In one of the most significant data protection rulings we’ve seen in recent years, DNA testing company 23andMe has been fined £2.31 million by the UK’s Information Commissioner’s Office (ICO).
The fine follows a major data breach in 2023 that exposed deeply personal details of over 155,000 UK residents – and millions more worldwide.
The verdict? 23andMe simply didn’t do enough to protect people’s sensitive data.
What went wrong?
Back in 2023, hackers launched a “credential stuffing” attack. That’s when cybercriminals use stolen login details from one site to break into accounts on another – something that works all too often when people reuse passwords.
This allowed the attackers to access around 14,000 23andMe accounts directly. But because the site links users to genetic relatives, they were able to scrape data connected to nearly seven million people in total.
A warning ignored
The ICO was clear: the breach wasn’t just unfortunate, it was preventable. 23andMe failed to put basic protections in place, like multi-factor authentication or stronger password rules.
They didn’t spot the warning signs, and they didn’t act fast enough to fix the problems.
As Information Commissioner John Edwards put it: “23andMe failed to take basic steps to protect this information. Their security systems were inadequate, the warning signs were there, and the company was slow to respond. This left people’s most sensitive data vulnerable to exploitation and harm.”
What happens now?
The company has since filed for bankruptcy and 23andMe is being sold to a new owner, TTAM Research Institute, who say they’re committed to doing better. Promises have been made to improve data protection and give users more control, including the right to delete their data and opt out of research.
Can you claim compensation for the 23andMe data breach?
At Join the Claim, we believe strongly in holding companies accountable – especially when it comes to something as personal as your genetic data. This breach isn’t just about sloppy IT practices. It’s about trust, transparency, and the responsibility companies have to protect their users. Because once private information is out in the world, there’s no getting it back.
Despite 23andMe filing for bankruptcy, lawyers in the UK are still pursuing the company in a group action data breach claim.
Join the Claim connects consumers with SRA-regulated lawyers. Visit the claim page to check your eligibility if a claim is open with one of our trusted legal partners. If a group action has not yet been launched, you can register your interest and we’ll keep you informed if a partner firm decides to take a claim forward.
