Analysis and recovery steps: 23andMe data breach

This landing page is built for users searching whether the 23andMe breach affected their data, what information was exposed and which identity, phishing and credential risks matter next.

This page is built to answer the core user questions after a high-profile breach: what happened, what data may have been exposed, and what to do right now to reduce phishing, fraud, account-takeover and identity-theft risk.

Reported impact

About 6.9 million profiles and DNA Relatives records

Incident date

2023-10-06

Exposed data types

Profile information, Ancestry and DNA relatives profile data, Location, birth year and family-tree attributes for some users

Best next step

Check whether your email appears in known breach disclosures and move into recovery if phishing starts.

What happened

23andMe said attackers used credential-stuffing techniques against reused user passwords, then expanded access through the DNA Relatives feature into broader profile data connected to those accounts.

The strongest user risk is not only account exposure inside one service. Once attackers confirm identity attributes, family connections and mailbox overlap, follow-on phishing and identity abuse become much more believable.

What to do now if you may be affected

Step 1

Reset the 23andMe password and remove any reused password from email, banking, password manager and social accounts.

Step 2

Enable MFA and review account activity, connected profile details and notification settings.

Step 3

Treat follow-on emails, genealogy contact or account-verification prompts as higher risk after the breach.

Step 4

Document the incident and monitor for identity-theft, fraud or phishing waves that reference DNA, ancestry or family details.

Check breach exposure Open identity-theft planner

Frequently asked questions

What kind of data was exposed in the 23andMe incident?

Public reporting and company disclosures described profile and DNA Relatives-related data exposure for affected users and linked accounts, not just a simple password leak.

Why is password reuse such a big issue here?

Because the initial intrusion reportedly relied on credential stuffing, so reused passwords across other services increase takeover risk well beyond the breached platform.

Official sources and supporting reporting

23andMe incident update

Source used to support the timeline, impact framing or recovery guidance for the 23andMe incident.

Open source

US regulators and public reporting context

Source used to support the timeline, impact framing or recovery guidance for the 23andMe incident.

Open source