23andMe data breach under investigation in UK and Canada

Privacy regulators in Canada and the UK launched a joint investigation after 23andMe confirmed a credential-stuffing campaign (April 29–September 27) that allowed attackers to access and exfiltrate health reports and raw genotype data. The company reported that threat actors downloaded data for roughly 6.9 million customers (breaching about 14,000 accounts), with leaked records appearing on BreachForums and other sites; 23andMe required password resets and enabled two-factor authentication and faces multiple lawsuits and regulatory scrutiny.