UK and Canada governments launch full investigation into 23andMe mega breach
DNA firm lost sensitive data on millions of customers
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
Data watchdogs in the UK and Canada are now jointly investigating the data breach that hit 23andMe in October 2023.
The incident saw a threat actor post13 million pieces of 23andMe datafor sale on the dark web, including people’s origin estimation, phenotype and health information, photos and identification data, raw data, and some other account information.
The leak reportedly contained one million lines of data for Ashkenazi people, as well as more than 300,000 users of Chinese descent, with 4.1 million people living in the UK also compromised. Since this type of data doesn’t change over time, it is relevant to threat actors whenever they obtain it, and can be used inidentity theft, phishing attacks, and more.
Customer negligence?
Now, the UK’s Information Commissioner’s Office (ICO), and the Office of the Privacy Commissioner of Canada (OPC), have partnered to lead an investigation into the incident.
“People need to trust that any organization handling their most sensitive personal information has the appropriate security and safeguards in place,”commentedJohn Edwards, UK Information Commissioner.
“This data breach had an international impact, and we look forward to collaborating with our Canadian counterparts to ensure the personal information of people in the UK is protected.”
The two organizations will examine the scope of information that was exposed, and potential harm to affected people, as well as whether 23andMe had adequate safeguards in place. It will also investigate if the company notified affected individuals properly, as required by Canadian and UK data protection laws.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
In January 2024,23andMe blamed its customers for the data breach, telling a group of victims they “negligently recycled and failed to update their passwords following past security incidents unrelated to 23andMe."
“Therefore, the incident was not a result of 23andMe’s alleged failure to maintain reasonable security measures,” the letter read.
More from TechRadar Pro
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
This new phishing strategy utilizes GitHub comments to distribute malware
Should your VPN always be on?
Phishing attacks surge in 2024 as cybercriminals adopt AI tools and multi-channel tactics
