Thursday, July 17, 2025
ADVT 
National

Lack of appropriate safeguards led to 23andMe data breach, joint investigation finds

Darpan News Desk The Canadian Press, 17 Jun, 2025 10:35 AM
  • Lack of appropriate safeguards led to 23andMe data breach, joint investigation finds

Inadequate security measures opened the door to a data breach discovered two years ago at genetic testing company 23andMe, Canada's privacy watchdog says.

Privacy commissioner Philippe Dufresne and U.K. information commissioner John Edwards released the findings from their joint investigation of the breach, which affected almost seven million people, including nearly 320,000 in Canada.

Dufresne told a news conference Tuesday the breach is a cautionary tale for all organizations about the importance of data protection in an era of growing cyberthreats.

"It is particularly relevant at a time when more and more personal information is being collected, used and shared in a growing digital economy," he said.

23andMe, which filed for bankruptcy in March, sells testing kits that use a customer's saliva sample to uncover genetic information through DNA analysis.

Dufresne said the compromised data included highly sensitive information related to health, race and ethnicity, as well as details about relatives, date of birth, sex at birth and gender.

"We were also concerned to find that the stolen data was later offered for sale online, putting the personal information of affected individuals at further risk," he said.

Dufresne and Edwards announced last May they would look into the data breach's scope, the company's data handling safeguards and whether it adequately notified regulators and affected individuals about the lapse.

The investigation found the hacker used stolen log-in details — usernames or email addresses and passwords — from other websites affected by previous breaches and then entered those credentials into 23andMe’s log-in page until they found matches. 

Beginning on April 29, 2023, and over the course of five months, the hacker was able to obtain access to the accounts of more than 18,000 customers, according to a summary of the investigation's findings.

Customers could opt into a feature that allowed them to share information with genetic relatives. If this feature was activated, personal information accessible to the hacker could also include the data of thousands of other individuals to whom the owner of the compromised account was genetically linked — meaning the information of millions of customers was ultimately exposed.

The investigation found 23andMe "did not develop appropriate safeguardsto prevent the attack, the summary says. The deficiencies included:

— a lack of mandatory multi-factor authentication, which requires a user to enter more information than just a password;

— inadequate minimum password complexity requirements;

— a lack of robust checks to see if customers were reusing credentials that had been compromised in previous data breaches;

— and no additional protections to protect the most sensitive personal information, including raw DNA data, from being accessed and downloaded from an account.

The investigation also found 23andMe’s detection mechanisms failed to alert the company to clear signals that a hacker was attempting to gain, and had obtained, unauthorized access to large numbers of customer accounts.

Despite the urgency of the situation — and 23andMe being aware of the credential-based attack when it was potentially ongoing — it took the company four days to disable all active user sessions and implement a password reset for all customers, the summary says.

It also took 23andMe approximately one month to disable the self-service raw DNA download feature and implement mandatory multi-factor authentication, the investigation found.

Picture Courtesy: THE CANADIAN PRESS/Sean Kilpatrick

MORE National ARTICLES

Squamish, B.C., reports progress in fire fight, as northeast hopes for rain

Squamish, B.C., reports progress in fire fight, as northeast hopes for rain
There's optimism from firefighters and local authorities as crews battle blazes in opposite corners of British Columbia heading into the weekend.

Squamish, B.C., reports progress in fire fight, as northeast hopes for rain

Middle East de-escalation must be priority after Israel attacks Iran: Anand

Middle East de-escalation must be priority after Israel attacks Iran: Anand
Foreign Affairs Minister Anita Anand called for "de-escalation" after Israel attacked Iranian missile and nuclear sites Friday and Iran warned of "severe punishment" in retaliation.

Middle East de-escalation must be priority after Israel attacks Iran: Anand

Canada's top doctor Theresa Tam leaving position when term ends June 20

Canada's top doctor Theresa Tam leaving position when term ends June 20
Canada’s Chief Public Health Officer Dr. Theresa Tam is leaving her position at the end of next week.

Canada's top doctor Theresa Tam leaving position when term ends June 20

London-bound Air India flight with more than 240 aboard crashes after takeoff from Ahmedabad, India

London-bound Air India flight with more than 240 aboard crashes after takeoff from Ahmedabad, India
AHMEDABAD, India (AP) — An Air India passenger plane bound for London with more than 240 people on board including one Canadian crashed Thursday in India’s northwestern city of Ahmedabad, and there were no known survivors, officials said.

London-bound Air India flight with more than 240 aboard crashes after takeoff from Ahmedabad, India

Sikh groups ask Carney to withdraw Indian PM Modi's invitation to G7 summit

Sikh groups ask Carney to withdraw Indian PM Modi's invitation to G7 summit
Sikh groups are calling on Prime Minister Mark Carney to revoke his invitation to Indian Prime Minister Narendra Modi to attend the G7 summit in Alberta next week.

Sikh groups ask Carney to withdraw Indian PM Modi's invitation to G7 summit

Crown continues closing submissions in hockey players' sex assault trial

Crown continues closing submissions in hockey players' sex assault trial
Prosecutors in the sexual assault trial of five hockey players argue that offering sex can be a form of appeasement and a normal response in a "highly stressful, unpredictable event."

Crown continues closing submissions in hockey players' sex assault trial