ICO fine: 23andMe, genetic data breach data breach case

Decision

Regulator

ICInformation Commissioner's Office

acted against

Against

23andMe

Joint ICO and Canadian privacy commissioner investigation into the 2023 credential stuffing attack that exposed data of 155,592 UK residents; the ICO found security measures were inadequate.

Related cases

Consumer protectionActiveUnverifiedfiled Oct 2026California AG: 23andMeAttorney General Bonta Secures $6 Million Settlement in 23andMe LitigationCalifornia Attorney GeneralGovernanceActiveUnverifiedfiled Jan 2026RReyna sued v. 23andMe, Inc.Sued under the Administrative Procedures Act.N.D. Cal.Data breachDecidedfiled Dec 2025ICO fine: LastPass, 2022 breachThe ICO found weak security let a hacker who compromised employee laptops in August 2022 reach a backup database holding data of up to 1.6 million UK users.GBP 1.2 millionUK Information Commissioner's OfficeData breachActivefiled Aug 2025In re Coinbase Customer Data Security Breach LitigationConsolidated suits over the 2025 incident in which bribed overseas support agents leaked Coinbase customer data used in social engineering scams.S.D. N.Y.Data breachActivefiled Apr 2025In re PowerSchool Customer Data Security Breach LitigationConsolidated suits over the December 2024 breach of PowerSchool's student information system that exposed data of students and teachers across many school districts.S.D. Cal.Data breachSettledfiled Jan 2025FTC: GoDaddy, hosting securityThe FTC alleged that since 2018 GoDaddy failed to use reasonable security for its web hosting services, leading to breaches, while claiming strong protection.US Federal Trade CommissionData breachDecidedfiled Dec 2024DPC fine: Meta, 2018 Facebook breachTwo inquiries into a September 2018 Facebook data breach that affected about 29 million accounts worldwide, around 3 million in the EU/EEA, covering breach notification and data protection by design.EUR 251 millionIrish DPCData breachSettledfiled Oct 2024FTC: Marriott and Starwood, data breachesThe FTC alleged lax security led to three breaches from 2014 to 2020 affecting more than 344 million customers worldwide.US Federal Trade Commission