23andMe failed to protect user data ahead of major breach, say privacy watchdogs

Privacy watchdogs in Canada and the UK found that 23andMe failed to implement adequate security measures before a 2023 cyberattack that compromised the data of nearly seven million users, including genetic and ancestry information of over 320,000 Canadians and 150,000 individuals in the UK. The regulators cited the lack of multi-factor authentication and weak password requirements as key failures, contributing to a decline in the company's market value by 97% and its subsequent bankruptcy filing. While Regeneron Pharmaceuticals initially offered $256 million to acquire 23andMe, the bid was withdrawn after co-founder Anne Wojcicki submitted a competing $305 million offer through her nonprofit, TTAM Research Institute.

Analysis

A joint investigation by Canadian and UK privacy regulators determined that 23andMe's failure to implement basic security protections, notably the absence of multi-factor authentication and weak password requirements, directly contributed to a 2023 cyberattack that compromised the sensitive data of nearly seven million users, including genetic and ancestry information for approximately 320,000 Canadians and over 150,000 individuals in the UK. This security lapse triggered a severe downturn for the California-based company, leading to a market value plunge of over 97% since its public listing, the resignation of all seven independent directors in September 2023, and a subsequent bankruptcy filing in March. While Regeneron Pharmaceuticals initially proposed a $256 million acquisition, this offer was retracted after 23andMe co-founder Anne Wojcicki, through her nonprofit TTAM Research Institute, submitted a competing $305 million bid, which is expected to be finalized following court approval. TTAM has pledged to uphold 23andMe's existing privacy commitments and comply with all relevant data protection laws, but the incident serves as a stark illustration of the extensive consequences of inadequate data security practices for organizations handling sensitive information.

Key Decisions for Investors

• Given 23andMe's bankruptcy and pending acquisition by a non-profit, any remaining equity value is highly speculative; attention should shift to the broader implications for data security standards in the genetic testing and healthcare sectors.
• Investors must rigorously assess the cybersecurity frameworks and data privacy protocols of companies within their portfolios, particularly those managing large volumes of sensitive personal information, as the 23andMe case demonstrates the potential for catastrophic value destruction following security breaches.
• The withdrawal of Regeneron Pharmaceuticals' bid for 23andMe underscores the complexities and risks associated with acquiring companies post-significant data breaches, suggesting that thorough due diligence into data liabilities and reputational damage is paramount in such M&A activities.