EXPLORINEER
en

Archive — US — techcrunch

UK watchdog fines 23andMe over 2023 data breach

The UK ICO fined 23andMe £2.31 million for failing to protect genetic data in a 2023 breach that compromised over 155,000 UK users. Hackers accessed accounts without multi-factor authentication, violating data protection laws. In response, 23andMe has implemented mandatory multi-factor authentication and is in talks regarding bankruptcy and a potential sale.

Key points

  • The UK ICO fined 23andMe £2.31 million for data protection violations.
  • The breach involved the theft of data from over 6.9 million users.
  • Thousands of accounts were accessed using stolen credentials over several months.
  • 23andMe did not have multi-factor authentication at the time of the breach.
  • The ICO stated over 155,000 UK users had their personal data stolen.
  • 23andMe announced the implementation of mandatory multi-factor authentication.
  • The company is in discussions regarding bankruptcy protection and a sale.

Why it matters

  • This incident highlights ongoing concerns about data security in tech companies.
  • As of 2025, an increasing emphasis on cybersecurity regulations is expected.
  • The demand for genetic data security is critical as health tech continues to grow.
  • The case underscores the importance of multi-factor authentication in protecting sensitive data.

The ICO's action against 23andMe serves as a warning for tech companies about the necessity of robust data protection measures, especially in a rapidly evolving digital landscape.