23andMe to pay $30 million in settlement over 2023 data breach

23andMe suffered a credential-stuffing driven data breach in 2023 that exposed profile information — and potentially genetic and health data — for millions of customers, with subsets of records targeting Ashkenazi and China-based users posted for sale on criminal forums and the dark web; the incident led to a class-action lawsuit and an expected $30 million settlement (largely covered by cyberinsurance) and ongoing investigations by other countries.