The 2023 23andMe data breach involved credential-stuffing attacks from April to September 2023, compromising genetic data of 6.9 million customers. Investigations revealed the company failed to implement basic safeguards such as multifactor authentication, password blocklisting, rate limiting, intrusion prevention, and breach detection monitoring. The breach was initially denied by the company, which blamed customers' password practices. The stolen data was later sold on the dark web. The settlement with a coalition of 43 attorneys general includes $18 million payment and mandates new security measures including a data security advisory board and risk analysis protocols. The breach also triggered class-action lawsuits, regulatory fines, and contributed to the company's bankruptcy and asset sale.

The breach exposed sensitive genetic ancestry information of millions of customers, which was stolen and partially sold on the dark web. This represents a significant privacy violation with potential long-term consequences for affected individuals. The company faced legal and financial repercussions including a multistate settlement, class-action lawsuits, regulatory fines, and bankruptcy. The incident undermined trust in 23andMe's ability to protect highly sensitive personal data.

The vendor has agreed to a settlement imposing new security requirements, including establishing a data security advisory board, implementing risk analysis protocols, and maintaining consumer rights to delete data. There is no indication of a software patch or fix since this was a failure of security controls and monitoring. Organizations should verify that 23andMe has implemented these mandated controls. Customers should review their account security and consider the implications of their genetic data exposure. Patch status is not applicable; remediation involves organizational and procedural improvements mandated by the settlement.