23andMe Agrees to $18M Settlement With 43 States Over 2023 Data Breach

23andMe agreed to an $18 million settlement following a 2023 credential-stuffing attack that directly accessed roughly 14,000 accounts and—by abusing the optional DNA Relatives feature—exposed genetic and personal information tied to approximately 6.9 million people; regulators argued weaker account protections enabled the breach and highlighted the lasting harm of exposed DNA data, while recommending stronger authentication and password hygiene.