23andMe and the Incident Response Problem Written in DNA

California sued 23andMe alleging that credential stuffing and a vulnerable "DNA Relatives" feature allowed an attacker to access ~14,000 accounts and harvest information on nearly 7 million users (including ~855,000 Californians), with data later offered for sale on the dark web; the report critiques failures in authentication, monitoring, rate-limiting, and incident response and draws lessons on treating genetic data as highly sensitive.