What Happens When Hackers Get Your DNA Data? Ask 23andMe

In late 2023, DNA testing company 23andMe disclosed a breach that compromised the personal and genetic data of millions of users [1]. Unlike a typical cybersecurity incident involving passwords or payment information, this attack exposed deeply personal insights—ancestry details, genetic markers, family connections—that are impossible to reset. 23andMe 23andMe disclosed a breach [1] impossible to reset This breach was a turning point in the digital health and biometric era. It shattered assumptions about consumer genetics platforms, revealed the cascading risks of weak authentication, and ignited regulatory scrutiny around the world. Most importantly, it showed what happens when genomic data, an immutable digital fingerprint, is left vulnerable. The breach did not occur in isolation. 23andMe had long struggled to build a sustainable business model. After going public, it failed to turn a profit, relying heavily on one-time kit sales without building strong recurring revenue streams. Its attempt to pivot into therapeutics also failed to gain traction. These structural issues created a fragile foundation, one that left the company especially vulnerable when the breach occurred. The attack became a final blow, compounding legal, reputational, and operational pressures that had already been mounting. final blow This report offers a full examination of the 23andMe breach: what happened, how the attackers exploited design weaknesses, the scope and sensitivity of the data exposed, the regulatory and legal consequences, comparisons with other biotech incidents, and actionable lessons for anyone safeguarding biometric or genomic data. full examination of the 23andMe breach safeguarding biometric or genomic data 1. What Happened: Timeline, Method, and Exposure 1. What Happened: Timeline, Method, and Exposure Credential Stuffing at Scale Credential Stuffing at Scale In October 2023, a hacker calling themselves "Golem" began leaking datasets allegedly stolen from 23andMe accounts [2]. The data was categorized by ethnic group—initially Ashkenazi Jewish and Chinese users—indicating a possible intent to target specific populations [3]. The leak eventually expanded to include over 6.9 million profiles [1]. [2] [3] over 6.9 million profiles [1] Unlike a traditional exploit of infrastructure, this breach relied on credential stuffing: the automated injection of breached username-password combinations from other platforms into 23andMe’s login portal. Roughly 14,000 accounts were directly accessed, but each account's participation in the "DNA Relatives" feature allowed the attacker to scrape the profile data of millions of related users [4]. credential stuffing 14,000 accounts [4] Timeline of Events Timeline of Events April–September 2023: Credential stuffing attack launched, slowly compromising thousands of accounts. October 2023: Reddit post reveals 23andMe user data being sold on the dark web. October 2023: 23andMe publicly discloses the breach. October 2023: A class-action lawsuit is filed. November 2023: 40% workforce reduction. October 2024: $30 million legal settlement, mostly covered by cyber insurance. April 2024: CEO Anne Wojcicki proposes taking the company private—rejected by the board. September 2024: Entire board resigns due to strategic disagreements. March 2025: 23andMe files for Chapter 11 bankruptcy and Wojcicki steps down. March, 2025: 23andMe has proposed an auction for the sale of its assets [6]. April–September 2023: Credential stuffing attack launched, slowly compromising thousands of accounts. April–September 2023: Credential stuffing attack launched, slowly compromising thousands of accounts. April–September 2023 October 2023: Reddit post reveals 23andMe user data being sold on the dark web. October 2023: Reddit post reveals 23andMe user data being sold on the dark web. October 2023 October 2023: 23andMe publicly discloses the breach. October 2023: 23andMe publicly discloses the breach. October 2023 October 2023: A class-action lawsuit is filed. October 2023: A class-action lawsuit is filed. October 2023 November 2023: 40% workforce reduction. November 2023: 40% workforce reduction. November 2023 October 2024: $30 million legal settlement, mostly covered by cyber insurance. October 2024: $30 million legal settlement, mostly covered by cyber insurance. October 2024 April 2024: CEO Anne Wojcicki proposes taking the company private—rejected by the board. April 2024: CEO Anne Wojcicki proposes taking the company private—rejected by the board. April 2024 September 2024: Entire board resigns due to strategic disagreements. September 2024: Entire board resigns due to strategic disagreements. September 2024 March 2025: 23andMe files for Chapter 11 bankruptcy and Wojcicki steps down. March 2025: 23andMe files for Chapter 11 bankruptcy and Wojcicki steps down. March 2025 March, 2025: 23andMe has proposed an auction for the sale of its assets [6]. March, 2025: 23andMe has proposed an auction for the sale of its assets [6]. March, 2025 [6] Notably, this bankruptcy filing doesn’t involve immediate liquidation (as in Chapter 7) but rather a strategic attempt to restructure the company’s debt and potentially sell off business units while maintaining limited operations. As part of this process, it has been reported that sensitive data infrastructure could be auctioned, raising new concerns about the fate of user DNA data. sensitive data infrastructure could be auctioned What Was Leaked What Was Leaked The breach exposed both direct user account data and connected profile data, including: direct user account data connected profile data Full names, usernames, profile photos Genetic ancestry reports, haplogroup information Birth years, locations, family surnames Ethnicity percentages and geographic origin data Connections to relatives via DNA Relatives Full names, usernames, profile photos Full names, usernames, profile photos Genetic ancestry reports, haplogroup information Genetic ancestry reports, haplogroup information Birth years, locations, family surnames Birth years, locations, family surnames Ethnicity percentages and geographic origin data Ethnicity percentages and geographic origin data Connections to relatives via DNA Relatives Connections to relatives via DNA Relatives While initially believed to exclude raw genetic files, later disclosures confirmed that some health reports and raw genotype data had been downloaded before 23andMe disabled access [5]. some health reports and raw genotype data [5] By early 2025, as part of its Chapter 11 proceedings, 23andMe announced plans to auction off corporate assets—including potentially sensitive user data or related infrastructure [6]. This move sparked renewed criticism from privacy advocates concerned that genomic data could be sold as part of a bankruptcy process. auction off corporate assets [6] 2. Genomic Privacy and the Permanence Problem 2. Genomic Privacy and the Permanence Problem The breach ignited new fears over genetic identity theft—a risk that’s qualitatively different from traditional PII leaks. DNA data is not just unchangeable; it is inherently social. A person’s genetic profile also reveals information about their relatives, ethnic group, and potential health predispositions. genetic identity theft inherently social Weaponization of Genetic Data Weaponization of Genetic Data By labelling and segmenting datasets by ethnicity (e.g. “Chinese,” “Ashkenazi Jewish”), attackers introduced the potential for genetic data to be used for racial profiling or targeted harassment. Experts noted the possibility of this data being used to: racial profiling or targeted harassment Identify individuals or families from genealogy data Target ethnic minorities with hate speech or misinformation Reveal hereditary disease risks or stigmatizing traits Identify individuals or families from genealogy data Target ethnic minorities with hate speech or misinformation Reveal hereditary disease risks or stigmatizing traits This breach made abstract concerns about genomic privacy painfully real [3]. [3] DarkOwl revealed that the breach was first advertised on Hydra Market in August 2023 by a user named Dazhbog, who claimed to possess over 300TB of DNA data for sale, targeting ethnic groups and geographies like Ashkenazi Jews, Chinese, and UK-linked individuals. Later, a threat actor known as Golem released portions of the data on Telegram and Breach Forums—some of it allegedly timed in response to the October 7 Israel-Gaza conflict. This suggests not only a financial motive but also a geopolitical one, where genetic data was deliberately weaponized to provoke tension and incite harm [14]. advertised on Hydra Market 300TB of DNA data for sale ethnic groups and geographies October 7 Israel-Gaza conflict geopolitical one genetic data was deliberately weaponized [14] But the risks extend even further. Once your DNA is leaked, it can’t be changed. It’s a permanent identifier—and that opens the door to much darker misuse: permanent identifier Top 5 Threats of Genetic Data Misuse Biometric Identity Theft / Impersonation – DNA used to forge identities in biometric systems; irreversible and uniquely tied to you. Framing or Incrimination via DNA Planting – Genetic evidence can be fabricated and planted at crime scenes, leading to false accusations. Real-world example: In 2009, Israeli scientists from Nucleix published a paper titled Fabricating DNA Evidence, proving that fake DNA could be created using a real profile and standard lab equipment—enough to pass forensic authentication. Targeted Bioweapons – Biological weapons could theoretically be designed to exploit specific genetic vulnerabilities in individuals or ethnic populations. Familial Exposure and Privacy Breach – Your genome contains sensitive information about your relatives—none of whom may have consented to its exposure. Genetic Discrimination by Insurers and Employers – Individuals could face denial of coverage, increased premiums, or lost job opportunities based on genetic predispositions, even in regions with legal protections. Biometric Identity Theft / Impersonation – DNA used to forge identities in biometric systems; irreversible and uniquely tied to you. Biometric Identity Theft / Impersonation – DNA used to forge identities in biometric systems; irreversible and uniquely tied to you. Biometric Identity Theft / Impersonation Framing or Incrimination via DNA Planting – Genetic evidence can be fabricated and planted at crime scenes, leading to false accusations. Real-world example: In 2009, Israeli scientists from Nucleix published a paper titled Fabricating DNA Evidence, proving that fake DNA could be created using a real profile and standard lab equipment—enough to pass forensic authentication. Framing or Incrimination via DNA Planting – Genetic evidence can be fabricated and planted at crime scenes, leading to false accusations. Framing or Incrimination via DNA Planting Real-world example: In 2009, Israeli scientists from Nucleix published a paper titled Fabricating DNA Evidence, proving that fake DNA could be created using a real profile and standard lab equipment—enough to pass forensic authentication. Real-world example: In 2009, Israeli scientists from Nucleix published a paper titled Fabricating DNA Evidence, proving that fake DNA could be created using a real profile and standard lab equipment—enough to pass forensic authentication. Real-world example: Real-world example: In 2009, Israeli scientists from Nucleix published a paper titled Fabricating DNA Evidence, proving that fake DNA could be created using a real profile and standard lab equipment—enough to pass forensic authentication. Targeted Bioweapons – Biological weapons could theoretically be designed to exploit specific genetic vulnerabilities in individuals or ethnic populations. Targeted Bioweapons – Biological weapons could theoretically be designed to exploit specific genetic vulnerabilities in individuals or ethnic populations. Targeted Bioweapons Familial Exposure and Privacy Breach – Your genome contains sensitive information about your relatives—none of whom may have consented to its exposure. Familial Exposure and Privacy Breach – Your genome contains sensitive information about your relatives—none of whom may have consented to its exposure. Familial Exposure and Privacy Breach Genetic Discrimination by Insurers and Employers – Individuals could face denial of coverage, increased premiums, or lost job opportunities based on genetic predispositions, even in regions with legal protections. Genetic Discrimination by Insurers and Employers – Individuals could face denial of coverage, increased premiums, or lost job opportunities based on genetic predispositions, even in regions with legal protections. Genetic Discrimination by Insurers and Employers Long-Term Implications Long-Term Implications Just as the 2015 OPM breach raised concerns about the future misuse of stolen fingerprints [13], the 23andMe incident raises a chilling prospect: what could adversaries do with stolen genetic data five or ten years from now? From personalized social engineering attacks to discriminatory profiling, the potential uses are only beginning to emerge. [13] what could adversaries do with stolen genetic data five or ten years from now? The leak also undermines consumer trust in biotech. If users lose faith in a platform’s ability to safeguard their DNA, they may abandon it altogether, stalling genetic research and commercial diagnostics. 3. Why Security Controls Failed 3. Why Security Controls Failed The 23andMe breach wasn’t a case of a sophisticated intrusion through technical zero-days—it was a failure of basic security hygiene and feature design. basic security hygiene feature design Authentication and Monitoring Weaknesses Authentication and Monitoring Weaknesses The attackers used credential stuffing to gain access. While users bear some blame for password reuse, the platform failed to enforce two-factor authentication (2FA) by default until after the breach [4]. platform failed to enforce two-factor authentication (2FA) [4] Key gaps included: Key gaps included: 2FA was optional, not mandatory. Login attempts from unusual IPs or behaviors went undetected for months. There were no apparent safeguards against automated scraping once logged in. 2FA was optional, not mandatory. 2FA was optional, not mandatory. Login attempts from unusual IPs or behaviors went undetected for months. Login attempts from unusual IPs or behaviors went undetected for months. There were no apparent safeguards against automated scraping once logged in. There were no apparent safeguards against automated scraping once logged in. automated scraping The breach persisted for five months, from April to September 2023, without triggering effective alarms [5]. [5] Abuse of DNA Relatives Feature Abuse of DNA Relatives Feature The attackers didn’t exploit a vulnerability—they used the system exactly as intended. The DNA Relatives feature let users view data about genetically related individuals. Once an attacker accessed a single account, they could systematically scrape information from hundreds or even thousands of genetic matches. exactly as intended hundreds or even thousands of genetic matches This wasn’t just a breakdown in authentication. It reflected a failure to anticipate how product features could be weaponized, especially in volatile geopolitical contexts. The breach coincided with heightened tensions in the Israel–Palestine conflict, and disproportionately affected individuals identified as Ashkenazi Jewish or Chinese—raising questions about motive and intent. While there’s no conclusive proof of nation-state or hacktivist involvement, the targeting of specific ethnic groups suggests a calculated interest in identity-based data. failure to anticipate how product features could be weaponized It’s a reminder that risk isn’t static. Just as rare earth elements became strategically valuable with the rise of semiconductors, the value of certain datasets can spike in response to world events—and so can the motivation to exploit them. the value of certain datasets can spike in response to world events 4. Legal and Regulatory Consequences 4. Legal and Regulatory Consequences The scale and nature of the 23andMe breach sparked immediate legal repercussions and intensified regulatory scrutiny—especially given that genetic data is treated as sensitive personal data under laws like GDPR, CCPA, and various state-level biometric privacy statutes. sensitive personal data Lawsuits and Settlements Lawsuits and Settlements Within weeks of the breach becoming public, 23andMe faced multiple class-action lawsuits in the U.S., alleging negligence, breach of contract, and failure to protect sensitive health data. Plaintiffs argued that the company had failed to implement basic protections such as mandatory MFA and effective monitoring systems [5]. [5] By March 2024, the company agreed to a $30 million settlement to resolve a consolidated class action. While 23andMe did not admit wrongdoing, the settlement required them to introduce sweeping reforms, including: $30 million settlement Mandatory two-factor authentication for all users Regular cybersecurity audits Clear deletion policies for inactive accounts Enhanced breach notification protocols Mandatory two-factor authentication for all users Mandatory two-factor authentication for all users Regular cybersecurity audits Regular cybersecurity audits Clear deletion policies for inactive accounts Clear deletion policies for inactive accounts Enhanced breach notification protocols Enhanced breach notification protocols Federal and State Regulatory Scrutiny Federal and State Regulatory Scrutiny The Federal Trade Commission (FTC) had already taken action against another DNA testing company—1Health/Vitagene—for deceptive practices and lax security in 2023 [6]. That case set a precedent: genetic testing companies can be investigated under the FTC Act for unfair or deceptive data practices, especially when consumers are misled about how their DNA will be used or stored. Federal Trade Commission (FTC) [6] unfair or deceptive data practices Following the breach, California’s Attorney General emphasized the importance of genomic privacy and recommended that consumers review their account settings and data-sharing preferences [7]. California’s Attorney General [7] If 23andMe’s European customers were affected, regulators under the General Data Protection Regulation (GDPR) may also intervene. Genetic data is classified under GDPR as a “special category” requiring explicit consent and extra protections. A breach involving such data could trigger fines of up to 4% of global revenue. General Data Protection Regulation (GDPR) “special category” fines of up to 4% of global revenue TOS Controversy TOS Controversy In the wake of the breach, 23andMe controversially updated its Terms of Service to prohibit class-action lawsuits, pushing users into individual arbitration. Critics, including digital rights groups, accused the company of trying to limit legal accountability. The FTC had previously warned in other cases that retroactive changes to privacy terms without user consent could themselves be grounds for enforcement [6]. Terms of Service to prohibit class-action lawsuits [6] 5. Reputational Fallout and Industry Comparisons 5. Reputational Fallout and Industry Comparisons Trust Lost, Brand Damaged Trust Lost, Brand Damaged For a company like 23andMe—built on consumer trust—the damage was existential. Users entrust genetic testing firms with their most personal data, and any breach can provoke lasting fear and backlash. In this case, the fallout was swift and severe. most personal data In March 2025, less than two years after the breach, 23andMe filed for Chapter 11 bankruptcy, citing a collapse in consumer demand and a reputational hit it couldn’t recover from [7]. The company’s market value had dropped over 99% from its peak, and attempts to sell the business failed. Chapter 11 bankruptcy [7] Though other market factors were at play—including the saturation of direct-to-consumer testing—the breach is widely seen as a triggering event that eroded customer loyalty and business viability. triggering event Other Biotech Breaches: Lessons from Peers Other Biotech Breaches: Lessons from Peers The 23andMe incident is part of a growing pattern: MyHeritage (2018): A breach exposed 92 million email/password combinations, though genetic data was not leaked thanks to segregated systems [9]. DNA Diagnostics Center (2021): Exposed Social Security numbers and test records for 2 million users due to legacy system failures [11]. GEDmatch (2020): Privacy settings were reset in a breach that exposed genetic data to law enforcement searches without user consent. Ancestry’s RootsWeb (2017): User credentials leaked through a misconfigured server, though no genetic data was compromised [10]. MyHeritage (2018): A breach exposed 92 million email/password combinations, though genetic data was not leaked thanks to segregated systems [9]. MyHeritage (2018): [9] DNA Diagnostics Center (2021): Exposed Social Security numbers and test records for 2 million users due to legacy system failures [11]. DNA Diagnostics Center (2021): [11] GEDmatch (2020): Privacy settings were reset in a breach that exposed genetic data to law enforcement searches without user consent. GEDmatch (2020): Ancestry’s RootsWeb (2017): User credentials leaked through a misconfigured server, though no genetic data was compromised [10]. Ancestry’s RootsWeb (2017): [10] The key pattern? Credential-based breaches and weak privacy controls repeatedly enable mass data exposure. The 23andMe breach stands out for the scale of its genomic exposure and its long-term business consequences. Credential-based breaches and weak privacy controls 6. 23andMe Breach: Lessons and Security Recommendations 6. 23andMe Breach: Lessons and Security Recommendations The 23andMe breach underscores a pattern cybersecurity teams must address: feature abuse, weak authentication, and excessive trust in interconnected systems. This wasn’t a classic perimeter breach—it was a failure to anticipate how legitimate features and authenticated access could be turned against the platform. Key Security Takeaways Key Security Takeaways Mandate MFA by Default Optional two-factor authentication doesn’t meet the threat model of consumer genomics. Platforms handling sensitive data must enforce MFA for all users—not just as a best practice, but as a formal requirement under OWASP ASVS 2.1.3 (Level 3) Model for Feature Abuse, Not Just Exploits DNA Relatives wasn’t “vulnerable” in the traditional sense—but became a powerful data-harvesting tool after account takeover. Security reviews must include abuse-case threat modeling, not just code audits. Detect Anomalous Behavior and Limit Overuse The attackers operated slowly and quietly. Behavioural monitoring and granular rate limiting are essential for catching “low-and-slow” attacks that bypass basic alerting. Encrypt and Segment Critical Data Assets MyHeritage avoided deeper fallout in 2018 because DNA data was logically separated and encrypted. 23andMe’s architecture exposed too much once authenticated. Access control must extend beyond login. Practice Data Minimization by Design Retention policies shouldn’t wait for litigation. Deleting dormant accounts and minimizing data collection reduces blast radius and aligns with modern privacy principles. Detection Lag Is a Threat Multiplier It took over five months for 23andMe to detect the breach. That’s five months of unchecked data exfiltration—long after the breach had gone public on criminal forums. Cyber Insurance Doesn’t Guarantee Survival Even though 23andMe’s policy reportedly covered $25M of a $30M legal settlement, it couldn’t salvage the brand or stop the downward spiral. Insurance is not a substitute for security. Own the Narrative During Incident Response Pointing fingers at users damaged trust. A strong response requires clear communication, visible change, and a shared sense of accountability. For a closer look at what 23andMe actually fixed in the aftermath, Demyd Maiornykov breaks it down here. Mandate MFA by Default Optional two-factor authentication doesn’t meet the threat model of consumer genomics. Platforms handling sensitive data must enforce MFA for all users—not just as a best practice, but as a formal requirement under OWASP ASVS 2.1.3 (Level 3) Mandate MFA by Default Mandate MFA by Default Optional two-factor authentication doesn’t meet the threat model of consumer genomics. Platforms handling sensitive data must enforce MFA for all users—not just as a best practice, but as a formal requirement under OWASP ASVS 2.1.3 (Level 3) OWASP ASVS 2.1.3 (Level 3) OWASP ASVS 2.1.3 (Level 3) Model for Feature Abuse, Not Just Exploits DNA Relatives wasn’t “vulnerable” in the traditional sense—but became a powerful data-harvesting tool after account takeover. Security reviews must include abuse-case threat modeling, not just code audits. Model for Feature Abuse, Not Just Exploits Model for Feature Abuse, Not Just Exploits DNA Relatives wasn’t “vulnerable” in the traditional sense—but became a powerful data-harvesting tool after account takeover. Security reviews must include abuse-case threat modeling, not just code audits. Detect Anomalous Behavior and Limit Overuse The attackers operated slowly and quietly. Behavioural monitoring and granular rate limiting are essential for catching “low-and-slow” attacks that bypass basic alerting. Detect Anomalous Behavior and Limit Overuse Detect Anomalous Behavior and Limit Overuse The attackers operated slowly and quietly. Behavioural monitoring and granular rate limiting are essential for catching “low-and-slow” attacks that bypass basic alerting. Encrypt and Segment Critical Data Assets MyHeritage avoided deeper fallout in 2018 because DNA data was logically separated and encrypted. 23andMe’s architecture exposed too much once authenticated. Access control must extend beyond login. Encrypt and Segment Critical Data Assets Encrypt and Segment Critical Data Assets MyHeritage avoided deeper fallout in 2018 because DNA data was logically separated and encrypted. 23andMe’s architecture exposed too much once authenticated. Access control must extend beyond login. Practice Data Minimization by Design Retention policies shouldn’t wait for litigation. Deleting dormant accounts and minimizing data collection reduces blast radius and aligns with modern privacy principles. Practice Data Minimization by Design Practice Data Minimization by Design Retention policies shouldn’t wait for litigation. Deleting dormant accounts and minimizing data collection reduces blast radius and aligns with modern privacy principles. Detection Lag Is a Threat Multiplier It took over five months for 23andMe to detect the breach. That’s five months of unchecked data exfiltration—long after the breach had gone public on criminal forums. Detection Lag Is a Threat Multiplier Detection Lag Is a Threat Multiplier It took over five months for 23andMe to detect the breach. That’s five months of unchecked data exfiltration—long after the breach had gone public on criminal forums. Cyber Insurance Doesn’t Guarantee Survival Even though 23andMe’s policy reportedly covered $25M of a $30M legal settlement, it couldn’t salvage the brand or stop the downward spiral. Insurance is not a substitute for security. Cyber Insurance Doesn’t Guarantee Survival Cyber Insurance Doesn’t Guarantee Survival Even though 23andMe’s policy reportedly covered $25M of a $30M legal settlement, it couldn’t salvage the brand or stop the downward spiral. Insurance is not a substitute for security. Own the Narrative During Incident Response Pointing fingers at users damaged trust. A strong response requires clear communication, visible change, and a shared sense of accountability. For a closer look at what 23andMe actually fixed in the aftermath, Demyd Maiornykov breaks it down here. Own the Narrative During Incident Response Own the Narrative During Incident Response Pointing fingers at users damaged trust. A strong response requires clear communication, visible change, and a shared sense of accountability. For a closer look at what 23andMe actually fixed in the aftermath, Demyd Maiornykov breaks it down here. here Conclusion Conclusion The 23andMe breach will be remembered not just for what was exposed, but for what it revealed: the fragility of trust in platforms built on personal identity data. Unlike breaches at Equifax or Anthem, this one touched genetic identity—information that cannot be changed, revoked, or easily resecured. fragility of trust in platforms built on personal identity data To be clear, the breach didn’t single-handedly sink the company. It was the final blow in a longer unravelling. Stock performance had already been declining, and the incident amplified broader concerns about platform safety, business viability, and long-term public trust. There are deeper, structural lessons here, too. Cyber insurance didn’t save the company. The reputational damage was too great, and the pivot to drug development failed. Strategic execution couldn’t keep up with investor expectations; fundamentally, a one-time DNA test isn’t a sustainable business model. Without recurring value, even the most sensitive data becomes a commodity. Cyber insurance didn’t save the company. The breach wasn’t caused by a single bug or exploit. It was the product of systemic design choices that prioritized access over restraint. In the age of genomic and biometric data, cybersecurity must evolve beyond perimeter controls. It must protect relationships between datasets, not just the data itself. age of genomic and biometric data, cybersecurity must evolve beyond perimeter controls For biotech companies, security can no longer sit in the backend. It must be woven into architecture, user experience, and data governance from day one. Because in genomics, trust isn’t a value-add—it’s the entire value proposition. And once it’s broken, there may be no way to get it back. woven into architecture, user experience, and data governance from day one Data breaches are evolving. Is your security strategy keeping up? Data breaches are evolving. Is your security strategy keeping up? A check-the-box pentest won't cut it if you're handling genomic or health data. Sekurno delivers real-world threat modelling, OWASP-driven testing, and compliance-aligned reports built for HIPAA, FDA, and MDR environments. real-world threat modelling OWASP-driven testing compliance-aligned reports HIPAA, FDA, and MDR → Book your biotech pentest today → Book your biotech pentest today References References Wikipedia – 23andMe Data Leak arXiv – Analysis of Credential Stuffing & 23andMe EFF – What to Do If You’re Concerned About the 23andMe Breach Risk Strategies – Understanding the 23andMe Breach and Ensuring Cybersecurity BleepingComputer – 23andMe to Pay $30 Million in Genetics Data Breach Settlement Bloomberg Law – 23andMe Demise Puts 15 Million Users’ DNA Info on Auction Block Reuters – 23andMe Files for Chapter 11 Bankruptcy to Sell Itself FTC – 1Health (Vitagene) Failed to Protect DNA Data, Changed Privacy Terms The Verge – MyHeritage Confirms 92M User Accounts Compromised Twingate – Ancestry Data Breach via RootsWeb TechTarget – DNA Diagnostics Center Reaches $400K Settlement After Data Breach OWASP ASVS – Authentication Requirements (2.1.3) Reuters – 56 Million Fingerprints Stolen in OPM Breach DarkOwl – 23andMe Suffers Data Breach Wikipedia – 23andMe Data Leak Wikipedia – 23andMe Data Leak arXiv – Analysis of Credential Stuffing & 23andMe arXiv – Analysis of Credential Stuffing & 23andMe EFF – What to Do If You’re Concerned About the 23andMe Breach EFF – What to Do If You’re Concerned About the 23andMe Breach Risk Strategies – Understanding the 23andMe Breach and Ensuring Cybersecurity Risk Strategies – Understanding the 23andMe Breach and Ensuring Cybersecurity BleepingComputer – 23andMe to Pay $30 Million in Genetics Data Breach Settlement BleepingComputer – 23andMe to Pay $30 Million in Genetics Data Breach Settlement Bloomberg Law – 23andMe Demise Puts 15 Million Users’ DNA Info on Auction Block Bloomberg Law – 23andMe Demise Puts 15 Million Users’ DNA Info on Auction Block Reuters – 23andMe Files for Chapter 11 Bankruptcy to Sell Itself Reuters – 23andMe Files for Chapter 11 Bankruptcy to Sell Itself FTC – 1Health (Vitagene) Failed to Protect DNA Data, Changed Privacy Terms FTC – 1Health (Vitagene) Failed to Protect DNA Data, Changed Privacy Terms The Verge – MyHeritage Confirms 92M User Accounts Compromised The Verge – MyHeritage Confirms 92M User Accounts Compromised Twingate – Ancestry Data Breach via RootsWeb Twingate – Ancestry Data Breach via RootsWeb TechTarget – DNA Diagnostics Center Reaches $400K Settlement After Data Breach TechTarget – DNA Diagnostics Center Reaches $400K Settlement After Data Breach OWASP ASVS – Authentication Requirements (2.1.3) OWASP ASVS – Authentication Requirements (2.1.3) Reuters – 56 Million Fingerprints Stolen in OPM Breach Reuters – 56 Million Fingerprints Stolen in OPM Breach DarkOwl – 23andMe Suffers Data Breach DarkOwl – 23andMe Suffers Data Breach