23andMe Research Institute

23andMe disclosed a credential stuffing attack occurring between late April and September 2023, discovered on October 1, 2023. Threat actors used compromised credentials to access customer accounts, exfiltrating DNA Relatives profile data, genetic health reports, and personal settings. The company engaged forensic experts, notified law enforcement, forced password resets, and mandated two-step verification.