Spain fines 23andMe nearly $3 million for cybersecurity failings enabling 2023 hack

23andMe experienced an April 2023 data breach impacting roughly 6.9 million accounts; the compromise was uncovered when a sample of the data surfaced for sale on Reddit. Spanish regulators attributed the incident to credential stuffing enabled by the company’s lack of mandatory multifactor authentication and inadequate access controls, fined the firm €2.4M, and the company later settled with 42 state attorneys general for $18M while committing to improved data protections.