23andMe credential stuffing and DNA Relatives data scraping
Between April and September 2023 attackers logged into about 14,000 23andMe accounts with passwords reused from other breaches. Through the opt-in DNA Relatives feature, those accounts exposed profile data on about 6.9 million other users, including names, birth years, locations, relationship labels and ancestry. 23andMe disclosed on October 6, 2023 after data was offered for sale, and later required two-step verification for all users.
- Victim
- 23andMe
- Industry
- Healthcare
- Country
- United States
- Intrusion began
- Apr 2023
- First disclosed
- Oct 6, 2023
- Actor
- Financially motivated
- Initial access
- Credential stuffing
- Identity control that failed
- Authentication
- MFA
- Not enforced on the abused account
- Abused identity
- Human account
- Records affected
- 6.9 million (About 6.9 million people whose profile data was exposed, per 23andMe; roughly 14,000 accounts (0.1 percent) were directly accessed. The ICO counted 155,592 UK residents.)
- Disclosed cost
- Not disclosed
The identity lesson
A feature that lets one login see data about thousands of other people multiplies the cost of each stuffed account. Mandatory MFA, breached-password screening and rate limits on bulk relative views were the missing controls the ICO named.
Regulatory and legal outcome
UK ICO fined 23andMe 2.31 million pounds on June 17, 2025, citing the lack of mandatory MFA and of extra verification before raw genetic data could be accessed or downloaded.
Go deeper on SWI
- Technique: Credential stuffing
Sources
- 23andMe Form 8-K/A (cybersecurity incident update), US SEC, Dec 1, 2023
- Addressing data security concerns, 23andMe, Oct 6, 2023
- 23andMe fined for failing to protect UK users' genetic data, Information Commissioner's Office, Jun 17, 2025
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- Chick-fil-A One loyalty accounts taken over by credential stuffing 2026 · Credential stuffing
- FortiBleed campaign harvests credentials through FortiGate devices 2026 · Credential stuffing
- Roku account credential stuffing in two waves 2024 · Credential stuffing
- Chick-fil-A One account credential stuffing 2023 · Credential stuffing
Cite this record
SWI Community Team. (2026). 23andMe credential stuffing and DNA Relatives data scraping. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2023-23andme-credential-stuffing-dna-relatives/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.