23andMe Breach: Reused Passwords Exposed 155,592 UK Users
Nobody hacked a DNA database. Attackers logged in with passwords people had already used somewhere else, and the site did not require a second check.
By Siddharth ShankarUpdated October 12, 2026On June 17, 2025, the UK Information Commissioner's Office fined 23andMe £2.31 million after credential stuffing attacks that began in April 2023 gave attackers access to the personal information of 155,592 UK residents. The ICO found no mandatory multi-factor authentication and weak password protocols. See how credential stuffing works.
Your email may already be in a known data breach. Find out in about 30 seconds.
Free · About 30 seconds · No sign-up · Email not stored
Genetic ancestry services hold information that is deeply personal and permanent. The 23andMe case is about how that kind of information was reached: not by a technical break-in, but by logins that attackers already had.
What happened
The ICO fined 23andMe £2.31 million, announced on June 17, 2025. It found that 155,592 UK residents had personal information accessed without authorization. The credential stuffing attacks began in April 2023. In October 2023, an employee found the stolen data advertised for sale on Reddit, and 23andMe confirmed a breach.
The ICO's investigation was carried out jointly with the Privacy Commissioner of Canada. The regulator received 12 complaints.
How it worked
Credential stuffing means trying logins that were leaked in earlier, unrelated breaches. If a person reused the same email and password on 23andMe, the attacker could simply sign in. The ICO found that 23andMe lacked mandatory multi-factor authentication, secure password protocols and unpredictable usernames.
It also found no additional verification step for downloading raw genetic data, and inadequate threat monitoring and incident response. Taken together, the ICO's view was that the company did not put enough protection around some of the most sensitive data a service can hold.
What was exposed
The ICO says the information included names, birth years, self-reported location, profile images, race, ethnicity, family trees and health reports. The exact data varied by account.
Information Commissioner John Edwards said the information "cannot be changed or reissued like a password or credit card number." A leaked password can be replaced, but a family tree or health history cannot. That permanence is why the regulator treated the lack of basic protections so seriously.
How it ended
The ICO fine is the outcome in the release. As with most fines, it is paid to the government and not to the people affected. The release does not describe compensation for individuals.
The case is also an example of how a breach can be detected late. The attacks started in April 2023, and 23andMe confirmed the breach only after an employee noticed the data being sold in October 2023.
Do not guess. See which breaches include your email and what leaked.
Free · About 30 seconds · No sign-up · Email not stored
A timeline of the case
The sequence is short but telling. Credential stuffing began in April 2023. For about six months nobody inside the company raised the alarm. In October 2023, an employee noticed the stolen data on Reddit, and 23andMe confirmed the breach. The ICO fine followed in June 2025, nearly two years later.
The gap between the start of the attacks and their discovery is the key detail. It matches the ICO's finding of inadequate threat monitoring and incident response.
Key facts at a glance
- Fine: £2.31 million, announced June 17, 2025
- UK residents affected: 155,592
- Attack began: April 2023
- Discovered: October 2023, after an employee found the data for sale
- Cause: credential stuffing using reused passwords
- Missing controls: mandatory multi-factor authentication, secure password protocols
Why this case matters
It shows that user behavior and company design are linked. A person who reuses a password has taken a risk, but the ICO placed the responsibility for stronger defaults on the service. Mandatory multi-factor authentication would have stopped logins that had only a leaked password.
For customers, the lesson is dual. Use a unique password everywhere, and treat genetic and health services as high-value accounts that deserve extra protection. If you ever shared a family tree or ancestry results, remember that relatives can be affected by what you chose to make visible, even if they never created an account themselves.
What you can do
1Use a different password on every account
A password manager makes this realistic.
2Turn on multi-factor authentication wherever it is offered
Choose an authenticator app where you can.
3Check whether your email appears in breach data
Our guide to checking whether your email was exposed explains how.
4Be careful about what you put in profiles
Family trees and location details affect relatives who never signed up.
What the release does not say
The release does not say how many people worldwide were affected, and we do not add a figure. For another account takeover story, see the CRA and GCKey credential stuffing report.
Want to apply this to your own situation? These explain how credential stuffing works, how to check whether your email has been exposed and what to do after your email appears in a breach in plain language. You can also try our free email exposure check.
Sources
- ICO: 23andMe fined £2.31 million for failing to protect UK users' genetic data (fine, date, 155,592 UK residents, April 2023 attacks, 12 complaints, missing MFA)
Frequently asked questions
How much was 23andMe fined?
The ICO fined it £2.31 million, announced on June 17, 2025.
How many UK residents were affected?
The ICO said 155,592 UK residents had personal information accessed without authorization.
How did the attackers get in?
By credential stuffing: using logins leaked in earlier, unrelated breaches, which worked where people had reused passwords.
What did the ICO say about the data?
John Edwards said the information cannot be changed or reissued like a password or credit card number.
See if your email has already leaked
- Checks your email against known data breaches
- Shows which sites leaked it, when, and what leaked
- We do not store the email you check
Change reused and leaked passwords
NordPass flags weak and reused passwords, and its Premium plan alerts you if your details appear in new breaches.
See NordPass →Affiliate link. We may earn a commission at no extra cost to you.
Prefer a one-time report first? Scan My Shadow, our sister service, $9.99.