The confluence of a significant data breach, subsequent financial difficulties culminating in bankruptcy proceedings, and a potential fine from regulatory bodies has created a perfect storm for 23andMe, the once-pioneering personal genomics company. Each of these issues is intertwined, with the data breach acting as a catalyst for the others.
The data breach, first reported in October 2023, stemmed from a "credential stuffing" attack. Cybercriminals used previously compromised usernames and passwords from other websites to gain unauthorized access to 23andMe user accounts. While the initial breach affected approximately 14,000 accounts directly, the interconnected nature of 23andMe's "DNA Relatives" feature allowed the attackers to access information from a far wider network, ultimately compromising the data of nearly 7 million users. The compromised data included sensitive personal information, such as ancestry details, self-reported location data, family trees, and, in some cases, health-related details and raw DNA sequences. The breach particularly targeted users with Ashkenazi Jewish and Chinese ancestry, raising concerns about potential discrimination and targeted attacks.
This breach had a devastating impact on 23andMe's reputation and financial standing. Customers, understandably concerned about the security of their most personal information, initiated class-action lawsuits alleging negligence and privacy law violations. In 2024, 23andMe agreed to pay $30 million to settle a consolidated class action lawsuit. However, the reputational damage was irreversible. Sales of 23andMe's DNA testing kits declined as consumers lost trust in the company's ability to protect their data.
Adding to the financial strain, 23andMe struggled to achieve sustained profitability, even before the data breach. The company's business model, primarily reliant on one-time purchases of DNA testing kits, proved unsustainable. Efforts to generate revenue through subscription services for health data and partnerships with pharmaceutical companies to leverage its vast genetic database failed to offset the declining sales of test kits. By early 2025, 23andMe's cash reserves dwindled, and the company reported a significant accumulated deficit. Cost-cutting measures, including layoffs and the discontinuation of its therapeutics division, were insufficient to stem the financial bleeding. In March 2025, 23andMe filed for Chapter 11 bankruptcy protection, seeking to restructure its debts and facilitate a sale of its assets.
Adding another layer of complexity, 23andMe is facing a potential fine from the UK's Information Commissioner's Office (ICO) following a joint investigation with Canadian authorities into the 2023 data breach. The ICO issued 23andMe with provisional findings and a notice of intent to fine the firm US$5.93 million for violations related to data protection under UK GDPR (General Data Protection Regulation). The ICO's investigation centered on the company's failure to uphold a high standard of security and governance in accordance with the UK GDPR, especially considering the sensitive nature of genetic information. The fine, if finalized, would be a substantial penalty and further exacerbate 23andMe's financial woes.
The future of 23andMe remains uncertain. The company is currently seeking a buyer for its assets, including its vast database of genetic information. However, the sale process raises significant ethical and legal concerns about the future use and protection of customer data. Consumer advocates and regulatory bodies are urging 23andMe customers to delete their data and are scrutinizing any potential sale to ensure that customer data remains protected. The 23andMe saga serves as a cautionary tale for other companies handling sensitive personal data, highlighting the importance of robust cybersecurity measures, transparent data governance practices, and sustainable business models.
