23andMe Holding Co.
bd_c6928174f9265a87 · schema v1 · pii pii-v1
Full breach record for 23andMe Holding Co. →23andMe Holding Co. filed an amended 8-K (Amendment No. 1) supplementing its October 10, 2023 disclosure regarding a credential stuffing incident. A threat actor accessed a small percentage (0.1%) of user accounts using credentials from other compromised sites. The incident exposed ancestry and health-related genetic data, and the actor posted shared profile information online. 23andMe engaged forensic experts, forced password resets, and implemented mandatory two-factor authentication. The incident status is contained.
J jump to incidentP pin to compareR raw source
Incident timeline
Oct 1, 2023
Discovered
Oct 10, 2023
Scope determined
Dec 1, 2023
Filed
vs. sector median
2 wks faster
Linked disclosures
Why this link?Regulatory filings (4) · sorted by filing gap
- Delaware State AGbd_983bec69f67e0ced2023-12-15 · +14dVerified
- California State AGbd_29c164e09dc57f932024-01-21 · +51dVerified
- Delaware State AGbd_ab14d4ca29340e512023-10-10 · +52dVerified
- SEC 8-Kbd_cd8db4669b886a802023-10-10 · +52dVerified
Filing propagation · 5 filings · 2 states
View merged incident ↗Pattern: first filing Oct 10 (DE), last Jan 21 (CA) — a 103-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?
Evidence ladder
Attacker assertion only. Establishes: claim date, group, alleged victim.
Unlocks: incident narrative, operational impact. Still no compliance clock.
Unlocks: discovery date, data types, affected count, compliance clock.
Unlocks: materiality, stated response, full audit trail. Ceiling removed.