History and stories
23andMe: reused passwords exposed millions
23andMe's own systems were not broken into. Attackers simply logged in with passwords people had used somewhere else.
1 min readStory
The short version
Attackers logged in to 23andMe accounts with passwords leaked from other sites, then used a sharing feature to reach millions more profiles.
The story
23andMe is a genetic testing company. In October 2023, data from its users’ profiles appeared for sale on a hacking forum. The company confirmed that data on about 6.9 million people had been taken.
The attackers did not break into 23andMe’s systems. They used credential stuffing: taking email and password pairs leaked from other websites and trying them on 23andMe. Where someone had reused a password, the login worked.
A feature called DNA Relatives let users share profile details with genetic matches. So from each account they got into, the attackers could see information about many other people who had opted in to sharing. A relatively small number of reused passwords led to millions of exposed profiles.
Shortly afterward, 23andMe and other genealogy sites began requiring two-factor authentication.
Why it mattered
It showed that one person’s reused password can expose people who did everything right. The company faced class action lawsuits and agreed to settle one in 2024. Regulators in the UK and Canada found its protections inadequate, and the UK regulator fined it.
The lesson today
Credential stuffing works because so many people reuse passwords. It does not matter how well the second site is protected if the password was leaked from the first. Unique passwords and multi-factor authentication stop it, and the larger the access an account has, the more that matters.
Talk to us about your technology
Tell us what you run today and what is getting in the way. We will get back to you about how we can help.