23andMe admits it didn’t detect cyberattacks for months

Executive summary: 23andMe experienced a prolonged account-compromise incident from April–September 2023 in which attackers brute-forced accounts (exploiting reused/public passwords) to access the DNA Relatives feature and steal ancestry and genetic data for approximately 6.9 million users; the breach was advertised on hacker forums and has prompted class-action lawsuits and public scrutiny of the company’s detection and security practices.