23andMe Faulted For Lax Security In 'Profoundly Damaging' 2023 Data Breach

Canadian and U.K. privacy regulators have criticized 23andMe for inadequate security measures that led to a data breach affecting nearly seven million users in October 2023. The probe revealed a lack of multi-factor authentication and weak password requirements, resulting in a £2.31 million fine in the U.K. and exposure of sensitive personal and health information. While 23andMe has settled a class-action suit for $30 million and is being acquired by TTAM Research Institute for $305 million with pledges to improve security, regulators warn of further enforcement if data protection lapses persist under the new ownership.

Analysis

Genetic testing firm 23andMe faced severe repercussions following an October 2023 data breach that exposed sensitive information of nearly seven million users, including 320,000 Canadians and 155,000 Britons. Joint investigations by Canadian and U.K. privacy watchdogs revealed critical security deficiencies, specifically the absence of multi-factor authentication and inadequate password requirements, which facilitated unauthorized access via recycled credentials. This negligence resulted in a £2.31 million fine from the U.K.'s Information Commissioner and strong condemnation for the company's slow response and failure to protect special-category genetic data. While raw DNA sequences were reportedly not compromised, hackers accessed and offered for sale personal details such as birth years, locations, family trees, and health reports. Financially, 23andMe agreed to a $30 million settlement in a class-action lawsuit, which includes three years of credit monitoring for affected individuals. The company is currently undergoing bankruptcy proceedings, with its assets set to be acquired by TTAM Research Institute for $305 million, an offer that surpassed Regeneron's bid. TTAM Research Institute has committed to legally binding improvements in data security and adherence to existing privacy policies, though regulators have explicitly warned that any future lapses under the new ownership will prompt further enforcement actions, underscoring the indelible nature of genetic information exposure.

Key Decisions for Investors

• Given 23andMe's bankruptcy and pending acquisition by TTAM Research Institute, direct investment focus should shift to evaluating TTAM's capability to integrate and secure the acquired assets and data effectively.
• Investors should closely monitor TTAM Research Institute's implementation of its promised data security enhancements and compliance with privacy regulations, as any failure could result in significant regulatory penalties and further erode the value of these assets.
• This incident highlights heightened regulatory scrutiny and substantial financial risks associated with data breaches in the genetic testing and broader healthcare data sectors, warranting increased due diligence on cybersecurity measures and governance for companies handling sensitive user information.