23andMe 2023 — Credential Stuffing Against 7 Million Genetic Profiles

In October 2023, 23andMe disclosed that attackers had accessed approximately 6.9 million genetic profiles. The attack itself was credential stuffing — using password lists from prior breaches, the same automated technique applied against thousands of login endpoints every day. What was exceptional was the architecture: 23andMe's DNA Relatives feature, designed to connect biological relatives, converted access to 14,000 accounts into visibility into 6.9 million profiles. Social features built on sensitive data carry a blast radius proportional to how deeply they connect users, and this case establishes a second theorem — genetic data, once exposed, cannot be made unexposed by the company that exposed it.

The Attack Chain

Phase 1: Credential Stuffing (14,000 accounts)

Attackers used credential stuffing — taking email/password combinations from previously breached databases and testing them against 23andMe's login endpoint. This is an automated, high-volume technique:

Credential stuffing flow:
  1. Attacker acquires combo list (email:password pairs from prior breaches)
     Sources: HaveIBeenPwned dataset, underground markets, breach forums

  2. Automated tool tests each credential against target login:
     POST /api/v1/auth/login
     {"email": "[e-mail]", "password": "Password123!"}

  3. Valid credentials → authenticated session
  4. Invalid → skip, try next

  Tools used: OpenBullet, SilverBullet, Sentry MBA
  Rate: hundreds of thousands of attempts per hour across distributed IPs

  23andMe had no MFA enforced for most accounts
  Approximately 14,000 accounts successfully accessed this way

Fourteen thousand accounts from a database of millions might seem limited — but 23andMe's DNA Relatives feature changed the scope entirely.

Phase 2: DNA Relatives Scraping (6.9 million profiles)

23andMe's DNA Relatives feature lets users opt in to share their profile data with genetic relatives identified through DNA matching. When a user opts in, their profile becomes visible to all matched relatives who are also opted in.

From each of the 14,000 compromised accounts, attackers could see the DNA Relatives profiles of every matched user — without needing their credentials:

DNA Relatives data accessible per compromised account:
  - Display name
  - Predicted relationship (2nd cousin, etc.)
  - Percentage DNA shared
  - Ancestral origin (ethnicity breakdown)
  - Location (if shared)
  - Profile photo (if shared)
  - Any additional profile information the user chose to share

Amplification:
  14,000 compromised accounts
  × ~500 DNA relatives visible per account (varies by user)
  = potential visibility into millions of profiles

Actual scraped: 6.9 million profiles

The attacker published the scraped data in segments on BreachForums, targeting specific ethnic communities. The first dataset published was labeled "Ashkenazi DNA Data" — approximately 1 million profiles of users with Ashkenazi Jewish ancestry, an apparent deliberate targeting of an ethnic group.

What Data Was Exposed

For the 14,000 directly compromised accounts:
  - All account data (health reports, raw genotype data, ancestry reports)
  - Contact information
  - Health predispositions (BRCA variants, pharmacogenetics, traits)

For the 6.9 million scraped DNA Relatives profiles:
  - Display name
  - Relationship labels
  - Ethnicity percentages
  - Geographic origin
  - Whether they had opted into health features
  - Profile photos (if shared)

What was NOT exposed in most scraped profiles:
  - Raw genotype data (the actual DNA sequence)
  - Health predisposition results
  - Email addresses
  - Precise location data

Why Genetic Data Breach Is Different

Standard PII breach:
  - Change password → neutralize credential exposure
  - Monitor for identity fraud → respond to misuse
  - Data becomes less sensitive over time

Genetic data breach:
  - DNA cannot be changed → permanent exposure
  - Reveals information about biological relatives (who were never customers)
  - Ancestry data enables ethnic profiling → hate crime targeting risk
  - Health predispositions → insurance discrimination risk
    (GINA — Genetic Information Nondiscrimination Act — protects employment,
     not life/disability insurance)
  - Future use unclear: what will genetic data enable in 20 years?

Regulatory specifics:
  - CCPA (California): genetic data is "sensitive personal information"
    → requires opt-in consent, right to deletion
  - HIPAA: does NOT apply to consumer DNA companies (not healthcare providers)
  - GDPR: genetic data is "special category" → highest protection tier
  - Most US states: no specific genetic privacy law

23andMe's Response and Legal Fallout

Timeline:
  September-October 2023: Breach occurs (exact start unclear)
  October 1: 23andMe aware of breach forum post
  October 6: 23andMe discloses publicly
  October 10: Broader scope disclosed; full 6.9M figure confirmed in
              December 2023 SEC filing (Form 8-K) — exact date disputed
  November 2023: 23andMe forces password resets for all users
  November 2023: MFA made available (not enforced)

Legal response:
  - 40+ class action lawsuits filed
  - Consolidated into MDL (Multi-District Litigation) in California
  - Settlement reached 2024: $30 million
    ($43.17 per claimant for affected California residents,
     $7.71 for others — subject to claim volume)

23andMe's position (controversial):
  In legal filings, 23andMe argued users were partly responsible
  for reusing passwords from other breaches
  → Framing: external attack, not internal security failure
  → Counterargument: opt-in DNA Relatives amplification was 23andMe's design

Technical Defenses That Would Have Helped

1. MFA enforcement — credential stuffing requires valid password alone
   If MFA had been mandatory: 14,000 credential stuffing successes → 0 authenticated sessions
   23andMe offered MFA but did not require it

2. Credential stuffing detection:
   - Rate limiting per IP and per account
   - Velocity checks (N failed logins in T time → block/CAPTCHA)
   - IP reputation feeds (known proxy/VPN/data center ranges)
   - Impossible travel detection (login from CN, login from US 5 minutes later)
   - Check credentials against HaveIBeenPwned API at login time

3. DNA Relatives data minimization:
   - Default-off (opt-out, not opt-in) for sharing with relatives
   - Pagination limits on relative scraping (can't fetch all 500 at once)
   - Anomaly detection: one account accessing thousands of relative profiles
   - Rate limiting on relative profile API

4. User notification:
   - Alert users to logins from new devices/locations
   - Forced re-authentication for sensitive data access (raw genotype download)

Credential Stuffing Defense Reference

# Checking credentials against HaveIBeenPwned at login time
# Uses k-Anonymity: only sends first 5 chars of SHA-1 hash
import hashlib, requests

def is_password_pwned(password: str) -> int:
    sha1 = hashlib.sha1(password.encode()).hexdigest().upper()
    prefix, suffix = sha1[:5], sha1[5:]
    r = requests.get(f"https://api.pwnedpasswords.com/range/{prefix}")
    for line in r.text.splitlines():
        h, count = line.split(':')
        if h == suffix:
            return int(count)  # number of times seen in breaches
    return 0

# At registration or password change:
if is_password_pwned(new_password) > 0:
    return error("This password has appeared in data breaches. Choose another.")

2025 Update: Genetic Data as Bankruptcy Asset

In March 2025, 23andMe filed for Chapter 11 bankruptcy. Genetic profiles collected from over 15 million customers were listed as company assets subject to the bankruptcy estate. Regeneron Pharmaceuticals acquired the genetic data as part of the asset purchase.

Users who consented to 23andMe's terms of service had not consented to data transfer to a pharmaceutical company. Regeneron is one of the largest biopharmaceutical companies in the world, with active programs in rare disease, oncology, and metabolic disorders — areas where large-scale genetic datasets have direct commercial value. The transfer occurred outside any user's consent model.

California Attorney General Rob Bonta issued guidance urging 23andMe customers to delete their data and opt out of research programs, citing the changed ownership. The FTC noted that consumer genetic data has characteristics — permanent, familial, health-predictive — that make standard bankruptcy data protections inadequate.

The blast radius argument made abstract in 2023 became concrete in 2025: a credential stuffing attack against a DNA testing company ultimately resulted in millions of genetic profiles passing to a pharmaceutical research company, transferred by bankruptcy court, without consent from any of the 15 million people whose DNA it represented.

The fundamental lesson: every default that trades security for convenience is an attack surface. 23andMe offered MFA and made it optional; they built a social feature that aggregated genetic profiles and made it opt-in. These defaults — easy to defend as user-friendly at product review — are what an attacker with a credential list and a scraper needed. The containerization ecosystem defaulted toward ease of use; genomic companies defaulted toward connection. Treating security controls as optional is the assumption attackers rely on.