23andMe to pay $30 million in genetics data breach settlement

23andMe experienced a credential-stuffing breach in 2023 that resulted in the theft and public leaking of sensitive data — including health reports and raw genotype files — for roughly 6.9 million customers (about 6.4 million U.S. residents). The incident led to multiple class-action lawsuits and a proposed $30 million settlement; 23andMe denies wrongdoing but agreed to strengthen security controls (mandatory 2FA, protections against credential stuffing, annual audits, incident response planning, and data-retention limits).