UK and Canada governments launch full investigation into 23andMe mega breach

Pls share this post

Listen to this article

Data watchdogs in the UK and Canada are now jointly investigating the data breach that hit 23andMe in October 2023.

The incident saw a threat actor post 13 million pieces of 23andMe data for sale on the dark web, including people’s origin estimation, phenotype and health information, photos and identification data, raw data, and some other account information.

The leak reportedly contained one million lines of data for Ashkenazi people, as well as more than 300,000 users of Chinese descent, with 4.1 million people living in the UK also compromised. Since this type of data doesn’t change over time, it is relevant to threat actors whenever they obtain it, and can be used in identity theft, phishing attacks, and more.

World's first modular handheld inkjet printer claims revolutionary print-on-any-surface capabilities — Chinese startup makes big promises but watch out for the price of consumables

Customer negligence?

Now, the UK’s Information Commissioner’s Office (ICO), and the Office of the Privacy Commissioner of Canada (OPC), have partnered to lead an investigation into the incident.

“People need to trust that any organization handling their most sensitive personal information has the appropriate security and safeguards in place,” commented John Edwards, UK Information Commissioner. 

“This data breach had an international impact, and we look forward to collaborating with our Canadian counterparts to ensure the personal information of people in the UK is protected.”

The two organizations will examine the scope of information that was exposed, and potential harm to affected people, as well as whether 23andMe had adequate safeguards in place. It will also investigate if the company notified affected individuals properly, as required by Canadian and UK data protection laws.

READ ALSO  AI is already better at analyzing financial reports than humans

In January 2024, 23andMe blamed its customers for the data breach, telling a group of victims they “negligently recycled and failed to update their passwords following past security incidents unrelated to 23andMe.”

“Therefore, the incident was not a result of 23andMe’s alleged failure to maintain reasonable security measures,” the letter read. 

More from TechRadar Pro


Pls share this post
Previous article
These AI-powered earbuds want to be the next big thing, but with Apple Intelligence in AirPods and Nothing’s ChatGPT buds, can they handle it?
Next articleElon Musk is beefing with Apple and Tim Cook again. It’s not the first time the Tesla CEO picked a fight with the iPhone giant.