23andMe to pay $18 million in new genetics data breach settlement

23andMe experienced a major credential-stuffing breach from April to September 2023 that resulted in the theft of 6.9 million customers' genetic and ancestry profiles, some of which were later sold and leaked on the dark web. Investigators found the company lacked basic protections (no multifactor authentication, insufficient rate limiting, intrusion prevention, or breach detection), and the incident led to multistate settlements, fines (including a UK ICO penalty), multiple class actions, Chapter 11 filings, and an eventual acquisition of assets.