Wednesday, July 16, 2025
ADVT 
National

Lack of appropriate safeguards led to 23andMe data breach, joint investigation finds

Darpan News Desk The Canadian Press, 17 Jun, 2025 10:35 AM
  • Lack of appropriate safeguards led to 23andMe data breach, joint investigation finds

Inadequate security measures opened the door to a data breach discovered two years ago at genetic testing company 23andMe, Canada's privacy watchdog says.

Privacy commissioner Philippe Dufresne and U.K. information commissioner John Edwards released the findings from their joint investigation of the breach, which affected almost seven million people, including nearly 320,000 in Canada.

Dufresne told a news conference Tuesday the breach is a cautionary tale for all organizations about the importance of data protection in an era of growing cyberthreats.

"It is particularly relevant at a time when more and more personal information is being collected, used and shared in a growing digital economy," he said.

23andMe, which filed for bankruptcy in March, sells testing kits that use a customer's saliva sample to uncover genetic information through DNA analysis.

Dufresne said the compromised data included highly sensitive information related to health, race and ethnicity, as well as details about relatives, date of birth, sex at birth and gender.

"We were also concerned to find that the stolen data was later offered for sale online, putting the personal information of affected individuals at further risk," he said.

Dufresne and Edwards announced last May they would look into the data breach's scope, the company's data handling safeguards and whether it adequately notified regulators and affected individuals about the lapse.

The investigation found the hacker used stolen log-in details — usernames or email addresses and passwords — from other websites affected by previous breaches and then entered those credentials into 23andMe’s log-in page until they found matches. 

Beginning on April 29, 2023, and over the course of five months, the hacker was able to obtain access to the accounts of more than 18,000 customers, according to a summary of the investigation's findings.

Customers could opt into a feature that allowed them to share information with genetic relatives. If this feature was activated, personal information accessible to the hacker could also include the data of thousands of other individuals to whom the owner of the compromised account was genetically linked — meaning the information of millions of customers was ultimately exposed.

The investigation found 23andMe "did not develop appropriate safeguardsto prevent the attack, the summary says. The deficiencies included:

— a lack of mandatory multi-factor authentication, which requires a user to enter more information than just a password;

— inadequate minimum password complexity requirements;

— a lack of robust checks to see if customers were reusing credentials that had been compromised in previous data breaches;

— and no additional protections to protect the most sensitive personal information, including raw DNA data, from being accessed and downloaded from an account.

The investigation also found 23andMe’s detection mechanisms failed to alert the company to clear signals that a hacker was attempting to gain, and had obtained, unauthorized access to large numbers of customer accounts.

Despite the urgency of the situation — and 23andMe being aware of the credential-based attack when it was potentially ongoing — it took the company four days to disable all active user sessions and implement a password reset for all customers, the summary says.

It also took 23andMe approximately one month to disable the self-service raw DNA download feature and implement mandatory multi-factor authentication, the investigation found.

Picture Courtesy: THE CANADIAN PRESS/Sean Kilpatrick

MORE National ARTICLES

Border bill raises questions about expanded data sharing with U.S.: Citizen Lab

Border bill raises questions about expanded data sharing with U.S.: Citizen Lab
An organization that monitors the effect of information flows on human rights says the new federal border security bill appears to "roll out a welcome mat" for expanded data-sharing agreements with the United States and other foreign authorities.

Border bill raises questions about expanded data sharing with U.S.: Citizen Lab

B.C. Opposition Leader John Rustad accuses former Conservative MLAs of blackmail

B.C. Opposition Leader John Rustad accuses former Conservative MLAs of blackmail
British Columbia Conservative Leader John Rustad is accusing a group of legislators who split from the party of blackmailing its members and staff in a bid to take over and divide the Opposition. 

B.C. Opposition Leader John Rustad accuses former Conservative MLAs of blackmail

Grizzly on island is safety risk, cannot be relocated, B.C. conservation officers say

Grizzly on island is safety risk, cannot be relocated, B.C. conservation officers say
British Columbia's Conservation Officer Service says a grizzly that has stalked people, harassed livestock and damaged property on an island is not a candidate for relocation. 

Grizzly on island is safety risk, cannot be relocated, B.C. conservation officers say

Weekend rain, cooler conditions allow crews to make progress on B.C. wildfires

Weekend rain, cooler conditions allow crews to make progress on B.C. wildfires
Firefighters are marking success in opposite corners of British Columbia after favourable weather this weekend allowed crews to rein in two prominent fires that have triggered evacuation orders and alerts.

Weekend rain, cooler conditions allow crews to make progress on B.C. wildfires

Surrey, B.C., police launch team to counter extortions in South Asian community

Surrey, B.C., police launch team to counter extortions in South Asian community
A series of reports of extortion from people and businesses in the South Asian community has prompted a wider investigation by police in Surrey, B.C. 

Surrey, B.C., police launch team to counter extortions in South Asian community

Police warn of hundreds of Hells Angels in Surrey, B.C., this weekend

Police warn of hundreds of Hells Angels in Surrey, B.C., this weekend
Police in Surrey, B.C., are warning residents about hundreds of Hells Angels who have arrived in the city, saying they have a history as "perpetrators and attractors of violence."

Police warn of hundreds of Hells Angels in Surrey, B.C., this weekend