23andMe Data Leak

Last updated: June 29, 2025

Target Audience

Keywords

Introduction

Overview

In October 2023, 23andMe, a leading genetic testing company, suffered a data breach affecting approximately 6.9 million users. The breach involved credential stuffing attacks that compromised personal and genetic data. The company implemented mandatory two-factor authentication following the attack, but legal action was taken due to concerns over data security and privacy practices.

Vulnerability Details

Hackers used credential stuffing to gain unauthorized access to 23andMe accounts, exposing user display names, sex, birth year, geographic location, and ethnicity estimates. The stolen data was initially leaked on BreachForums. Following the breach, a lawsuit was filed against the company for negligence and invasion of privacy. To enhance security, 23andMe mandated two-factor authentication for all users starting in December 2023. The breach underscored the importance of unique passwords and proactive cybersecurity measures.

Learning Objectives

  • Understand the impact of the 23andMe data breach on user privacy
  • Analyze the attack methods used and security vulnerabilities exploited
  • Evaluate key lessons learned regarding account security and data protection

Download

  • Includes a PDF case study adapted from a real-world cyber breach
  • Guided questions for student engagement
  • Instructor materials including context and background
  • All content packaged in a downloadable ZIP file

Remote Terminal

Terminal Description

Answer the following questions to assess your understanding of the 23andMe data breach.

  • Read the case study details carefully.
  • Select the most appropriate answer for each multiple-choice question.
  • Review key lessons from the breach and understand best security practices.

Relevant articles and reports on the 23andMe data breach.

Module Questions

What is the primary service provided by 23andMe?
Approximately how many users were affected by the 23andMe data leak reported in October 2023?
What type of personal information was compromised in the 23andMe data breach?
Which forum was used to initially leak the compromised data from 23andMe?
What legal action was taken in response to the 23andMe data breach in October 2023?
What security measure did 23andMe require starting in December 2023 to improve account security?
Which attack method was used to compromise user accounts in the 23andMe hack?
Who was attributed as the attacker in the 23andMe data breach?
What lesson was emphasized regarding user account security after the 23andMe hack?
What is a potential risk of opting into additional features on platforms like 23andMe, as highlighted in the presentation?