---
title: "23andMe security incident"
description: "What the retained public evidence establishes about the 23andMe incident, its attack path, impact, and response."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-09-19"
canonical_url: "https://www.ally.security/incidents/23andme-security-incident-2023"
markdown_url: "https://www.ally.security/incidents/23andme-security-incident-2023.md"
stix_url: "https://www.ally.security/incidents/23andme-security-incident-2023/stix.json"
---

# 23andMe security incident

The retained public source describes the 23andMe incident as Credential stuffing (reused passwords, no forced MFA) plus "DNA Relatives" feature scraping. Other material details remain unresolved.

Last modified Sep 19, 2026 · 1 source

## Summary

- **Environment:** Genetic testing/Biotech
- **Operational impact:** The reviewed source does not establish a precise operational or data impact
- **Financial impact:** No financial figure is established by the reviewed source evidence

## What happened

In 2023, 23andMe experienced an incident in its genetic testing/biotech environment. The retained source describes the attack path as follows: Credential stuffing (reused passwords, no forced MFA) plus "DNA Relatives" feature scraping. [1](#source-1)

## Impact

- The reviewed source does not establish a precise affected-person count, data scope, or operational consequence.
- No financial loss, ransom amount, recovery cost, or regulatory penalty is established by the reviewed source evidence.

## Threat Group & Attack Vector

The retained source describes the attack path as follows: Credential stuffing (reused passwords, no forced MFA) plus "DNA Relatives" feature scraping. The canonical record does not add intrusion steps beyond those supported by the source. [1](#source-1)

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- [T1110 — Brute Force](https://attack.mitre.org/techniques/T1110/) — mapped from the cited behavior. [1](#source-1)

## Response

The retained source describes containment action intended to limit further access or disruption. [1](#source-1)

This account is bounded to [23andMe Form 10-Q](https://www.sec.gov/Archives/edgar/data/1804591/000180459124000025/me-20231231.htm). Details absent from that evidence are left unresolved rather than inferred. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/23andme-security-incident-2023/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### 23andMe Form 10-Q

regulatory · U.S. Securities and Exchange Commission

<https://www.sec.gov/Archives/edgar/data/1804591/000180459124000025/me-20231231.htm>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Affected Organization · 100% confidence · current**  
   23andMe security incident: 23andMe
2. **Resulted In · 100% confidence · current**  
   23andMe security incident: The reviewed source documents the 23andme security incident involving 23andMe.
3. **Used Attack Technique · 90% confidence · current**  
   23andMe security incident: https://attack.mitre.org/techniques/T1110/
4. **Resulted In · 90% confidence · current**  
   23andMe security incident: The retained source describes containment action intended to limit further access or disruption.
5. **Resulted In · 87% confidence · current**  
   23andMe security incident: Credential stuffing (reused passwords, no forced MFA) plus "DNA Relatives" feature scraping.

</details>