2023 Credential stuffing & DNA Relatives scrape — 6.9M
Data compromised
Genetic data, ancestry info, DNA Relatives matches, names, usernames, birth years
Technical writeup
Credential stuffing combined with DNA Relatives feature scraping to expose genetic and personal data. A class settlement received final bankruptcy-court approval Jan. 30, 2026; the plan administrator approved a $46.75M victim fund June 2026 (Chrome Holding Co. Chapter 11).
Root cause
Credential stuffing; API abuse of DNA Relatives feature.
References
- https://www.reuters.com/world/us/23andme-notifies-customers-data-breach-into-its-dna-relatives-feature-2023-10-24/
- https://blog.23andme.com/articles/addressing-data-security-concerns
- https://www.23andmedatasettlement.com/
- https://www.reuters.com/world/california-sues-23andme-over-2023-data-breach-2026-05-28/
- https://therecord.media/bankruptcy-admin-approves-settlement-for-23andme-breach-victims