23andMe: 6.9 Million DNA Profiles Scraped via Credential Stuffing
Attackers used 14,000 compromised credentials from other breaches to log into 23andMe accounts, then exploited the DNA Relatives feature to scrape genetic data from 6.9 million additional profiles without any additional hacking.
Attack Chain
- 1Credential stuffing
- 2Valid logins identified
- 3DNA relative data accessed via API
- 46.9M profiles scraped
- 5Data listed for sale
Background
23andMe stores genetic testing data for over 14 million customers. Its "DNA Relatives" feature connects users with genetic matches, displaying shared ancestry data. This feature became the attack's force multiplier.
The Attack
Attackers ran credential stuffing attacks — trying username/password pairs from previously breached databases — and successfully accessed approximately 14,000 23andMe accounts whose users had reused passwords from other compromised services. Each compromised account had opted into DNA Relatives. By scraping all the relatives visible to each compromised account, attackers harvested profile data for 6.9 million users who had never had their passwords compromised. The attacker published a specific dataset of profiles targeting Ashkenazi Jewish and Chinese ancestry groups on dark web forums.
Response
23andMe forced a password reset for all users and mandated two-factor authentication. The company faced class actions and regulatory investigations in multiple countries. CEO Anne Wojcicki controversially suggested victims were partially responsible for reusing passwords. 23andMe filed for bankruptcy in 2025.
Outcome
The breach demonstrated the unique dangers of genetic data: unlike passwords or credit cards, DNA cannot be changed. The selective targeting of ethnic groups raised the spectre of DNA data being used for discriminatory or surveillance purposes.
Key Takeaways
- Genetic and biometric data is irreplaceable — it requires the highest tier of protection and access control
- Password reuse across services creates credential stuffing risk — enforce unique passwords and 2FA
- Social graph features (DNA Relatives, Friend Lists) multiply the blast radius of any account compromise
- Mandatory MFA should be default, not optional, for accounts storing sensitive personal data