United Kingdom · Cyber · 17 Jun 2025

23andMe fined £2.31m after weak logins exposed UK users' genetic data

£2.31 million fine (reduced from a proposed £4.59m)

Company: 23andMe
Regulator or court: Information Commissioner's Office (ICO)
Law: UK GDPR, Articles 5(1)(f) and 32(1) (security)
Status: Final

What happened

In 2023 attackers used passwords leaked in other, unrelated breaches to log into 23andMe accounts, reaching data on 155,592 UK users, including ancestry, health and ethnicity information. The ICO found the company had not required multi-factor authentication and had too few safeguards around downloading raw genetic data. The investigation was carried out jointly with Canada's privacy regulator.

Sources

ICO press release ICO enforcement page

Summary in our own words. General information, not legal advice.

Ready when you are

Could this happen to you? Let’s find out.

Tell me what you’re building. I’ll tell you what you need. No obligation.

Book an intro call

What happened

Reddit fined £14.47m for not checking the age of its users

Capita fined £14m after hackers stole data on 6.6 million people

First ever Privacy Act civil penalty: Australian Clinical Labs ordered to pay $5.8m

Could this happen to you? Let’s find out.