23andMe fined £2.3M by UK ICO for 2023 credential-stuffing breach

The UK ICO fined genetic testing company 23andMe £2.3 million after finding that it failed to put in place the necessary security measures to prevent a cyberattack. 

The 2023 attack affected over 150,000 UK-based individuals, leaking data sets containing sensitive information, including genetic ancestry details and information about users’ relatives. The ICO determined that 23andMe had not taken appropriate steps to guard the data, especially considering the sensitive nature of the information gathered by the company. 

It is also worth mentioning that 23andMe recently filed for bankruptcy protection and has since been dealing with a massive volume of data deletion requests the company is struggling to handle. 

This fine reminds companies dealing with highly sensitive data, especially if it is essential to their core business goals, how crucial it is to implement proper safeguards to protect users’ data and the company’s reputation.

‍