23andMe data breach: what happened and what to do
Last reviewed July 16, 2026 · 12 records on file · sources listed below
23andMe reached an $18 million bankruptcy settlement with 42 states, including Pennsylvania, after a data breach compromised the genetic data of 6.9 million consumers.
If you have an account with 23andMe, assume the exposed details are circulating. The practical risk today is rarely the leak itself — it is the calls and messages that use those details to sound legitimate.
What we have on file
Every entry below is a catalogued record with its original source. We do not paraphrase beyond what the source reports.
Personal Information · Unknown
A multimillion-dollar settlement has been approved for Canadian customers of 23andMe genetic testing company who were affected by a past data breach, confirming sensitive personal data was compromised.
Personal Information · Unknown
Genetic testing company 23andMe failed to take basic steps to protect customer data, leading to a massive global data breach, as per a joint investigation from Canada and the U.K.
Personal Information · Unknown
23andMe experienced a significant data breach involving sensitive personal data from customers, raising concerns about the handling of genetic information.
Personal Information · Unknown
DNA-testing company 23andMe settled a $30 million class-action lawsuit after a data breach exposed the personal information of roughly half of its customer base, affecting nearly 7 million customers.
Personal Information · Unknown
A data breach at 23andMe exposed the personal information of approximately 6.9 million customers, leading to a $30 million class action lawsuit settlement.
Personal Information · Unknown
23andMe has agreed to a $30 million settlement following a data breach that exposed genetic and ancestry information for 6.9 million customers. The breach, which occurred in 2023, led to a class action lawsuit accusing the company of failing to protect user data.
Personal Information · Unknown
23andMe experienced a data breach in late 2023 where unauthorized access to user accounts resulted in the exposure of personal information. The company reached a settlement in a class action lawsuit related to this incident, with eligible users potentially receiving compensation.
Personal Information · Unknown
23andMe suffered a data breach last year that resulted in data leaks for 6.9 million users. The company is now settling, and affected users may qualify for a portion of the settlement.
Personal Information · Unknown
23andMe settled a lawsuit for $30 million after failing to protect the privacy of 6.9 million customers whose personal information was exposed in a data breach last year. The settlement includes three years of security monitoring.
Personal Information · Unknown
DNA testing company 23andMe failed to implement adequate data protections, leading to a massive data breach almost two years ago. The breach exposed private information, and the company ignored warning signs prior to the incident, as found by Canada's privacy commissioner.
Personal Information · Hacking
In 2023, DNA testing company 23andMe suffered a data breach resulting from a hacking attack that exposed sensitive genetic and personal data of customers. A U.S. bankruptcy judge later ordered the parent company Chrome Holding to pay $47 million in compensation to victims as part of a settlement.
What to do
- Change the password anywhere you reused itThe exposure matters most when the same password protects your email, because email is how everything else gets reset.
- Treat every call and text about this breach as a scam until proven otherwiseNo company will ask you for a one-time code, a PIN or a password. Hang up and call the number printed on your card.
- Read your statements for the next three monthsCard fraud usually starts with a small test charge. Catching that one is what stops the large one.
- Give your email account a password nothing else usesIt is the account that can reset all the others, so it is the one worth protecting first.
Questions people ask
Was my data in the 23andMe breach?
Having an account alone does not confirm exposure. The reliable check is whether your email address appears in the leaked datasets in circulation — that takes seconds and does not require your password.
Is it too late to do anything?
No. Leaked personal details do not expire, and neither does the defence: a unique password on your email, and a fraud alert on your credit file, still work years later.
Will 23andMe contact me?
They may. But scammers contact people too, using exactly these breach details to sound convincing. Never act on an inbound call or text — call back on a number you already had.
701 organisations catalogued
Records are catalogued from public reporting and linked to their original source. iTellYou is not affiliated with the organisations listed. If you represent one of them and something here is inaccurate, write to us and we will correct it.