Spain Fines 23andMe Nearly $3 Million for Cybersecurity Failings Enabling 2023 Hack
ID: 010f8199-361a-58f4-90d4-c47d47211343
STIX ID: report--010f8199-361a-58f4-90d4-c47d47211343
Feed Name: CosmicBytez Labs
Threat Score
Spain's data protection authority (AEPD) fined 23andMe €2.77M after a late-2023 credential-stuffing campaign allowed attackers to harvest data from 6.9 million accounts (including ~2,600 Spanish residents), exposing sensitive genetic and health data; the regulator cited missing mandatory MFA, inadequate monitoring, and excessive data sharing via the DNA Relatives feature and found the company failed to apply heightened GDPR protections for special-category data.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.