California Attorney General sues 23andMe successor for 2023 data breach

California Attorney General Rob Bonta said he will sue DNA testing firm Chrome Holding after an investigation into its predecessor, 23andMe. The investigation alleged that 23andMe failed to take basic steps to protect sensitive customer data, leading to a 2023 breach that exposed genetic predispositions and risk factors for nearly seven million users. It also exposed information about biological relatives, ancestry, and ethnicity. Bonta alleged 23andMe misled consumers about the severity of the breach. He also alleged that threat actors later touted the sale of 23andMe user data on the dark web, targeting Asian American Pacific Islanders and Jewish users. The 2023 breach drew international regulatory scrutiny, including findings by the UK ICO about inadequate authentication and verification measures.

"Our investigation found that the company failed to take basic steps to protect users' data. Bonta said the failure resulted in a 2023 data breach which exposed genetic predispositions and risk factors of nearly seven million users, plus information about biological relatives, ancestry, and ethnicity. Bonta added that 23andMe lied to consumers about the severity of its 2023 data breach."

"Bonta also alleges the subsequent sale of 23andMe user data on the dark web by threat actors specifically touted that it belonged to Asian American Pacific Islanders (AAPI) and Jewish users. "This is disturbing and incredibly dangerous" given it occurred during a period of "mounting anti-Asian American and Pacific Islander and antisemitic hate and violence," Bonta said."

"Users were targeted by a so-called "credential stuffing" attack in which hackers used passwords exposed in previous breaches to access 23andMe accounts for which people had used similar credentials. The 2023 data breach has resulted in international regulatory scrutiny for the company. The ICO said personal data of 155,592 UK residents was accessed."

"The company has said it has "made several binding commitments to enhance protections for customer data and privacy." The ICO's probe was conducted in coordination with Canada's privacy commissioner and found 23andMe violated UK law by failing to implement appropriate authentication and verification measures for customers during its login process."

Read at www.bbc.com