The 23andMe data breach: what happened and what customers can do

23andMe did not say its systems were broken into. Its amended SEC filing of December 1, 2023 says a threat actor accessed about 0.1% of user accounts where people had used the same username and password as on other sites that had been compromised. The company's own update puts that at roughly 14,000 accounts of its 14 million customers.

What those accounts could see is the important part. In the directly accessed accounts, the data generally included ancestry information and, for a subset, health-related information based on genetics. Because those users had opted in to DNA Relatives, the attacker could also see profile information that their genetic matches had chosen to share: approximately 5.5 million DNA Relatives profiles and 1.4 million Family Tree profiles, according to the company. Some of it was posted online.

So most affected people did nothing wrong themselves. Their data was exposed through a relative's reused password.

The SEC filing describes the scraped data as profile information about other users' ancestry that they chose to share with genetic relatives. It is not a credit file, so it is not the kind of data used to open loans. The risks are privacy and targeting: being identified by ancestry, revealing relatives you did not know about, and scams or harassment that use those details.

Two things follow. First, a credit freeze is still a good habit but is not the specific fix here, unless other data in your account was involved. Second, genetic data cannot be changed, so the decision that matters is whether you want it held at all.

1. Use a unique password for 23andMe and any other genetics site, and never reuse one you have used elsewhere. A password manager makes this painless; see our password manager comparison.
2. Check your other accounts. If your 23andMe password was reused, the problem is wherever else it lives. Look yourself up on Have I Been Pwned, as our leaked password guide explains.
3. Keep two-step verification on. 23andMe requires it for all logins since November 6, 2023. Use an authenticator app if you can; see two-factor authentication.
4. Review what you share. In your settings you can turn off DNA Relatives or limit what matches see. Less shared means less exposed if a relative's account is taken over.
5. Decide whether to delete. The California Attorney General's consumer alert walks through deleting data from the "23andMe Data" section of Account Settings. 23andMe's help pages say deletion is permanent and cannot be undone, that some information is retained to meet legal obligations, and that you should download anything you want first. You can also change whether your saliva sample is stored.

23andMe filed for Chapter 11 bankruptcy in the US Bankruptcy Court for the Eastern District of Missouri in 2025. On June 13, 2025, it announced an agreement to sell substantially all its assets for $305 million to TTAM Research Institute, a nonprofit led by co-founder Anne Wojcicki, subject to court approval. In that announcement TTAM committed to honor customers' rights to delete their account and genetic data and to opt out of research, to email customers before closing, and to offer two years of free Experian identity theft monitoring. If you want your data gone, the deletion option above is the tool; it does not depend on who owns the company.