23andMe fined millions by UK watchdog over 'profoundly damaging' cyber attack

23andMe is being fined £2.31 million by the UK's privacy watchdog (ICO) following a 2023 data breach that compromised the personal information of seven million users, including over 150,000 Britons. The ICO cited repeated failures to protect sensitive data, including family trees, health reports, and ethnicity information, with Information Commissioner John Edwards calling it a "profoundly damaging breach." This action follows the company's bankruptcy filing in March and acquisition by co-founder Anne Wojcicki's non-profit TTAM for $305 million, amidst ongoing concerns about data security and deletion practices, as well as legal action from 28 US attorneys general.

Analysis

The UK's Information Commissioner's Office (ICO) has imposed a significant £2.31 million fine on genetic testing company 23andMe for a 2023 data breach that exposed the personal information of seven million individuals, including over 150,000 UK residents. The ICO characterized the breach as "profoundly damaging," citing 23andMe's "repeated failures to protect extremely sensitive data," inadequate security systems, unheeded warning signs, and a slow response to the incident which began in April 2023 but was only investigated from October 2023. The stolen data included highly sensitive details such as family trees, health reports, race and ethnicity information, addresses, and dates of birth, with a specific dataset of 999,999 individuals allegedly of Ashkenazi Jewish heritage appearing on dark web forums. This regulatory penalty follows 23andMe's bankruptcy filing in March of the current year (2025, per article date context) and its subsequent planned acquisition for $305 million by TTAM, a non-profit led by co-founder Anne Wojcicki. The company faces ongoing scrutiny, including a legal challenge from 28 US attorneys general aimed at protecting user data during the sale, and accusations from US Senator Josh Hawley regarding the veracity of its data deletion policies. While TTAM has made commitments to enhance data protection, including allowing data deletion and offering identity theft monitoring, the historical practice of 23andMe selling user data to entities like GSK underscores the complexities of data monetization and privacy. The ICO fine, described as "about as serious as it gets" by a cyber investigations director, will go to the state, unlike in the US where victims secured a $30 million class-action settlement, highlighting differences in legal redress mechanisms for data breach victims.

Key Decisions for Investors

• Investors should intensify due diligence on cybersecurity measures and data governance frameworks within companies handling sensitive personal information, as demonstrated by 23andMe's £2.31m fine, subsequent bankruptcy, and distressed $305m sale price, which underscore the severe financial and reputational repercussions of data breaches.
• Portfolio companies reliant on monetizing large-scale personal or genetic data require careful risk assessment, considering the escalating regulatory environment, potential for substantial fines, and the profound impact on consumer trust and enterprise value illustrated by 23andMe's experience.
• Monitor the activities of acquiring entities like TTAM and the enforceability of their data protection commitments, as the ongoing legal actions against 23andMe, even post-acquisition announcement, signal persistent liabilities and heightened scrutiny for businesses built on sensitive data assets.