23andMe Faces Lawsuit Over 2023 Data Breach Impacting 7 Million Users The California Attorney General, Rob Bonta, has filed a lawsuit against genetic-testing company 23andMe (now operating as Chrome Holding Co.) for its handling of a 2023 data breach that exposed the sensitive information of nearly 7 million users, including over 850,000 Californians. The complaint alleges that 23andMe failed to implement basic security measures, misled customers about the breach’s severity, and violated multiple state laws, including the Genetic Information Privacy Act and the California Consumer Privacy Act. The breach, which occurred over five months, stemmed from a credential-stuffing attack, where hackers exploited weak or reused passwords from other breaches including a prior incident at genealogy site MyHeritage, a 23andMe partner. Once inside, attackers exploited a coding flaw in the company’s “DNA Relatives” feature, allowing them to access ancestry reports, family histories, and health-related genetic data. The stolen information was later offered for sale on the dark web, with hackers specifically targeting data belonging to Asian-Pacific Islander and Jewish users amid rising hate crimes. 23andMe initially downplayed the incident, publicly confirming only 14,000 compromised accounts while withholding details about the broader exposure. The California Department of Justice’s investigation found that the company’s security practices “fell below industry standards”, despite its claims of robust protections. The lawsuit also accuses 23andMe of misleading customers by denying a security incident even after hackers revealed exploitable vulnerabilities during ransom negotiations. Founded in 2006, 23andMe was the first direct-to-consumer DNA testing company but faced financial struggles, filing for bankruptcy in 2023. Its assets were later acquired by the 23andMe Research Institute, a nonprofit that has distanced itself from the lawsuit, stating it was not involved in the events leading to the breach. The legal action seeks accountability for what Bonta described as a failure to “meet its obligation under California law to keep [users’] information safe.” The case highlights the risks of inadequate cybersecurity in handling highly sensitive genetic and personal data.

Global Cybersecurity Roundup: Ransomware Shifts, Major Breaches, and Law Enforcement Crackdowns This week’s cybersecurity landscape saw ransomware gangs adapt to declining payments, high-profile data breaches, and aggressive law enforcement actions targeting cybercrime enablers and fraud rings. ### Ransomware Payments Drop, But AI-Powered Gangs Rise Ransomware victims are paying less, forcing attackers to innovate. According to ReliaQuest, ransomware groups like The Gentlemen are leveraging AI to accelerate tool development and recruit affiliates, while Deadlock has refined evasion tactics. Despite a 51% year-over-year increase in victim listings (2,252 in Q2 2024), median ransom payments fell to $698,000 down from $1.3 million in 2023 per Sophos. Recovery costs, however, rose 11% to $1.7 million over the past year. Payment rates varied by sector: 72% of local/state governments paid, compared to 32% of retailers. Encryption success rates also climbed, with 56% of attacks locking systems in 2023. ### U.S. Sanctions Cybercrime Enablers The U.S. Treasury sanctioned Dmytro Rashevskyi (Ukraine) and Yegeniy Silayev (Belarus) for facilitating ransomware operations. Rashevskyi administered 1VPNS, a VPN service used by ransomware groups to conceal attacks, while Silayev sold cryptors to obfuscate malware. The VPN, dismantled in May, was linked to billions in losses across hospitals, businesses, and governments. ### Celine Dion Fans Targeted in Ticket Scam Scammers exploited demand for Celine Dion’s Paris concerts, using Facebook groups and cloned ticketing sites to defraud fans. Group-IB identified 20+ fraudulent domains mimicking Ticketmaster, AXS, and Dion’s official site, selling duplicate digital tickets via Shopify payments. Victims received seemingly legitimate transfers, but only the first buyer gained entry others were denied. The scam likely reused phishing kits from past high-profile tours. ### 23andMe Settles $18M Over 2023 Breach Genetic testing firm 23andMe (now Chrome Holding) agreed to an $18 million settlement with 43 U.S. states over a 2023 data breach exposing 7 million users. The breach stemmed from credential stuffing, with hackers advertising stolen data online. California’s lawsuit was partially dismissed, but the state may pursue non-monetary penalties. A separate $46.75 million settlement was approved for victims, including 855,000 Californians. ### China-Linked Malware Found in Taiwan Tech Firm Symantec discovered Backdoor.Daxin, a 13-year-old rootkit, on a compromised host at a Taiwan-based tech subsidiary. The malware, attributed to a Chinese state-sponsored group, hijacks legitimate TCP connections to evade detection. A new backdoor, Stupig, was also found, sharing code similarities with Daxin. Stupig exploits Windows’ keyboard-layout DLL to execute commands before login, bypassing security audits. ### Spiral Ransomware Hits IT Firm in Rapid Attack A South Asian IT services company was breached by Spiral, a Rust-based ransomware deployed within hours of initial access. Attackers exploited Microsoft IIS to upload a web shell, escalated privileges via UAC bypass, and exfiltrated credentials. The ransomware, active since June, features defense evasion, lateral movement, and encryption capabilities. ### Microsoft Patches 2 Zero-Days in July Update Microsoft fixed 622 vulnerabilities, including two actively exploited zero-days: - CVE-2026-56164 (SharePoint Server): Allows unauthenticated privilege escalation. - CVE-2026-56155 (Active Directory): Enables elevated access to enterprise systems. CISA ordered immediate patching for federal agencies, warning of ongoing attacks on SharePoint servers. The update also addressed a BitLocker bypass (CVE-2026-50661) and a SharePoint auth bypass (CVE-2026-55040). ### Spanish Police Dismantle €140M Cybercrime Ring A joint Europol-Interpol operation arrested four suspects linked to a €140 million ($160M) fraud ring spanning Spain, Portugal, and Panama. The group used 800+ bank accounts and 120 business fronts to launder funds from BEC scams and investment fraud. Authorities seized 15 computers, 170 phones, and froze $3.4 million in assets. ### Argentine Football Association Probes Fake Emails The AFA investigated a cyberattack after hackers sent fraudulent emails to journalists, falsely claiming Argentina’s World Cup win over Egypt was due to "corrupt refereeing." The messages, sent from an official AFA account, referenced Egypt’s support for Palestine. Early findings suggest credentials were leaked from an Egyptian online forum. The AFA is enhancing security measures.

Fallen DNA testing firm 23andMe won court approval of a bankruptcy plan that includes settlements to provide up to $62 million to resolve thousands of data breach claims. Judge Brian C. Walsh of the US Bankruptcy Court for the Eastern District of Missouri approved the plan in a Wednesday order, overruling most creditor objections and challenges from data breach victims. Many of those former customers’ objections were deemed moot or premature, and several of them didn’t appear at a court hearing on the plan. Objections from the Justice Department’s bankruptcy watchdog and a coalition of state attorneys general were resolved ...

The genetic testing company 23andMe faced a significant data breach exposing customers' personal and genetic information. The breach led to legal claims from affected users, prompting the company to propose settlements as part of its ongoing Chapter 11 bankruptcy proceedings. The exposed data included sensitive customer details, raising concerns over privacy, identity theft, and potential misuse of genetic information. The breach’s financial and reputational fallout contributed to the company’s restructuring efforts, with a judge reviewing settlement approvals to resolve customer claims. The incident underscores the severe consequences of failing to protect highly personal data in the biotech sector, particularly when such information can have long-term implications for individuals' health, insurance, and security.

23andMe, a company offering personal genetic testing services, has faced bankruptcy protection while holding a vast collection of sensitive genetic data. Privacy risks are heightened as this data might fall into new hands during a sale process, raising concerns over data protection and potential misuse. Legal frameworks like California’s right to deletion offer some safeguards, yet a national health privacy law in the US is lacking, leaving many customers vulnerable. Customers are advised to download and then request deletion of their personal genetic data to ensure their privacy.

In October 2023, 23andMe suffered a massive data breach exposing the personal and genetic data of nearly 7 million users, including highly sensitive DNA profiles, health records, and personally identifiable information (PII). The breach led to severe consequences for affected individuals, including identity theft, targeted harassment (especially against LGBTQ+ members like Salman Jaberi), mental health deterioration (e.g., Elvira Olguín’s vascular episode and vision loss due to stress), and financial fraud. The company filed for bankruptcy in March 2024, facing over 250,000 claims (many suspected fraudulent) tied to the incident, with settlements proposed at $30M–$50M (US) and $3.25M (Canada)—far below the claimed $51 trillion in damages. Victims reported long-term risks, such as nation-state exploitation of immutable DNA data, while the company struggled to verify legitimate claims. The breach’s unique harm—irreplaceable genetic data—heightened distress, with many users feeling the settlements provided insufficient relief for ongoing damages like privacy protection costs, medical expenses, and emotional trauma.

23andMe Bankruptcy Judge to Rule on Data Breach Settlements and Legal Fees A U.S. bankruptcy judge overseeing 23andMe’s Chapter 11 case will issue a final decision next week on settlements with victims of a 2023 data breach, along with contested legal fees for attorneys representing the claimants. Judge Brian C. Walsh of the U.S. Bankruptcy Court for the Eastern District of Missouri announced the ruling during a Tuesday hearing, setting the deadline for January 28. The case centers on two key agreements: one involving a class of U.S.-based victims and another tied to the company’s 2025 asset sale out of bankruptcy. While 23andMe has already resolved its financial restructuring, the remaining focus is on compensating data breach claimants and resolving disputes over legal fees. The breach, disclosed in late 2023, exposed sensitive genetic and personal data of millions of users, raising concerns over privacy and cybersecurity risks. The settlements under review aim to address these claims, though the final approval process has faced scrutiny over fairness and transparency. The judge’s upcoming ruling will determine the final terms of compensation and the allocation of legal costs, marking a critical step in resolving the fallout from one of the most significant genetic data breaches to date.

In 2023, 23andMe suffered a major data breach exposing highly sensitive genetic and ancestry data of nearly 7 million users. The compromised information included chromosomal haplogroups, family tree details, and ancestry profiles, with ethically charged consequences—such as curated dark web lists targeting individuals of Jewish and Chinese descent. Initially, the company blamed users for weak passwords, exacerbating public distrust. The fallout led to a costly class-action lawsuit, severe reputational damage, and heightened scrutiny over the company’s data stewardship practices. The breach underscored the risks of mishandling biometric and genetic data, which, unlike financial records, cannot be changed if exposed. The incident also highlighted systemic failures in incident response, transparency, and ethical data management, reinforcing the need for stricter protections around health-related and personally identifiable information (PII).

The California Office of the Attorney General reported a data breach involving 23andMe, Inc. on January 21, 2024. The breach occurred on two dates: April 29, 2023, and September 27, 2023. The breach involved the unauthorized access to personal information of customers, including genetic data and other sensitive information. The incident highlights the vulnerability of genetic testing companies to cyber threats and the potential for significant data leaks.

42 States Reach $18M Settlement with 23andMe Over 2023 Data Breach A coalition of 42 states, including Arizona, has finalized an $18 million settlement with biotech company 23andMe following a 2023 data breach that exposed the private information of millions of customers. The breach, which compromised sensitive genetic and personal data, prompted a multi-state investigation into the company’s security practices. The settlement resolves allegations that 23andMe failed to implement adequate safeguards to protect user data, leading to unauthorized access. While details of the breach’s scope and the specific vulnerabilities exploited remain under review, the agreement requires the company to enhance its cybersecurity measures and improve transparency around future incidents. The case underscores growing regulatory scrutiny over data privacy in the genetic testing industry, where personal and health-related information is increasingly targeted by cyber threats. The financial penalty and mandated reforms aim to hold 23andMe accountable while setting a precedent for similar cases.