UK and Canada's data chiefs join forces to investigate 23andMe mega-breach

Regulators in the UK (ICO) and Canada (OPC) have opened a joint investigation into 23andMe's October 2023 credential-stuffing breach, which directly accessed ~14,000 accounts but — due to the platform's DNA Relatives opt‑in and complex privacy settings — resulted in exposure of data tied to nearly 7 million users; the attacker known as "Golem" published the stolen data and made targeted, anti‑Semitic statements. The report highlights failures in detection (five months before discovery via a Reddit post), the late enabling of default 2FA in November 2023, and ensuing debate over customer security practices and the company’s communications.