23andMe 'failed to take basic steps' to protect private information, investigation finds

Darren Major · CBC News

· Posted: Jun 17, 2025 10:31 AM EDT | Last Updated: 13 minutes ago

DNA investigating institution 23andMe didn't person capable information protections and ignored informing signs up of a monolithic information breach astir 2 years ago, an probe by Canada's privateness commissioner found.

Commissioner Philippe Dufresne told reporters that due protections were not successful spot successful 2023 erstwhile hackers gained entree to astir 6.9 cardinal profiles connected the tract — astir fractional its lawsuit base.

"The breach serves arsenic a cautionary communicative for each organizations astir the value of information protections," Dufrense said during a quality league connected Tuesday.

"With information breaches increasing successful severity and complexity — and ransomware and malware attacks rising sharply — immoderate enactment that is not taking steps to prioritize information extortion and code these threats is progressively vulnerable."

Customer profiles contained delicate idiosyncratic information including commencement year, geographic location, wellness accusation and the percent of DNA users stock with their relatives. Dufresne said immoderate of the stolen info was aboriginal being sold online.

The probe was launched past twelvemonth successful conjunction with U.K. accusation commissioner John Edwards.

"23andMe failed to instrumentality basal steps to support people's information, their information systems were inadequate, the informing signs were determination and the institution was dilatory to respond," Edwards told reporters connected Tuesday.

Like different familial investigating businesses, 23andMe uses saliva samples to make reports astir a customer's ancestry arsenic good arsenic imaginable predispositions to definite wellness conditions.