23andMe, the genetic testing company, disclosed a recent data breach that exposed approximately 14,000 customer accounts. The breach impacted only 0.1% of its customer base, although hackers also gained access to files containing profile information about other users’ ancestry shared through the company’s DNA Relatives feature. The company immediately launched an investigation and engaged third-party incident response experts to assess the extent of unauthorized activity.
According to the company’s new filing with the US Securities and Exchange Commission, the hackers accessed a fraction of user accounts where usernames and passwords matched those compromised or available from other websites. The compromised accounts contained varying information, including ancestry details and some health-related information based on genetics. In response to the breach, 23andMe has implemented a mandatory password reset for all users and added two-step verification for new and existing users to enhance user data protection.
The financial implications of the breach are projected to result in one-time expenses between $1 million and $2 million during the fiscal third quarter ending on December 31. These expenses cover technology consulting services, legal fees, and third-party advisor costs. The breach has also led to multiple class-action claims against the company in various jurisdictions, including federal and state courts in California, a state court in Illinois, and courts in British Columbia and Ontario in Canada. The company is defending these cases while addressing notices under the California Consumer Privacy Act and inquiries from governmental officials and agencies.
While 23andMe believes its investigation into the breach is complete, it acknowledges the possibility of new information emerging. The company is committed to updating information as required by applicable law. The full extent of the costs and impacts of the breach, including insurance coverage, remains uncertain. 23andMe is in the process of providing notification to users impacted by the incident as required by applicable law.
The exposure of 23andMe users’ profile information has raised concerns about data security and user privacy. The company’s commitment to enhancing user data protection and providing timely updates to affected users will be critical in regaining consumer trust.
Overall, the breach highlights the significant cybersecurity challenges faced by companies that collect and store sensitive personal data. It also underscores the importance of proactive measures to safeguard user information and mitigate the impact of data breaches. As organizations continue to grapple with evolving cybersecurity threats, a comprehensive and responsive approach to data security will be essential to protect user privacy and maintain consumer confidence in the digital age.
