The 2023 23andMe data breach exposed sensitive genetic and personal information of nearly 7 million customers due to credential-stuffing attacks and a coding error in the 'DNA Relatives' feature. Attackers accessed accounts with weak credentials and a larger set of accounts not using the feature. The breach included genetic data, health predisposition, ancestry, and DNA matches. The California Attorney General filed a lawsuit citing failures in reasonable safeguards, intrusion detection, and misleading public statements, alleging violations of California privacy and consumer protection laws. The company faced lawsuits, regulatory fines, and bankruptcy. No vendor advisory or patch information is available. No known active exploits have been reported.

The breach exposed highly sensitive genetic and personal data of millions of customers, including detailed health predisposition and biological relatives information. This exposure poses significant privacy risks to affected individuals and potential misuse of genetic data. The legal and regulatory consequences for 23andMe include lawsuits, multi-million-dollar fines, and bankruptcy. The incident undermines trust in the company's data protection practices and highlights vulnerabilities to credential-stuffing attacks and coding errors.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The company has faced legal and regulatory actions for failing to implement reasonable safeguards and detect intrusions. Organizations using similar services should ensure strong credential policies and monitor for credential-stuffing attacks. Customers should use strong, unique passwords and enable multi-factor authentication if available. No official fix or remediation details from the vendor are provided in the available information.