# 23andMe: credential stuffing exposes 6.9M users' ancestry data · pwn.watch

> Attackers used reused passwords to log into about 14,000 23andMe accounts, then scraped the DNA Relatives profiles those accounts could see. Data on about 6.9 million people was exposed and sold on hacking forums.

Page: https://pwn.watch/i/23andme-credential-stuffing-data-breach-2023 · generated 2026-10-22T22:41:49.181Z

## Status
- Severity: high · status: closed · patch: no-fix-needed
- Product: 23andMe
- Started: 2023-10-06 · closed: 2023-12-04

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/23andme-credential-stuffing-data-breach-2023/feed.xml
- JSON Feed: https://pwn.watch/i/23andme-credential-stuffing-data-breach-2023/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/23andme-credential-stuffing-data-breach-2023.json
- This file: https://pwn.watch/i/23andme-credential-stuffing-data-breach-2023/llms.txt

## Updates (newest first)
- 2023-12-04: 23andMe confirms about 6.9 million people affected (https://techcrunch.com/2023/12/04/23andme-confirms-hackers-stole-ancestry-data-on-6-9-million-users/)
- 2023-10-06: 23andMe confirms user profile data was scraped and offered on hacking forums (https://blog.23andme.com/articles/addressing-data-security-concerns)

## Fix brief
# Security brief: 23andMe: credential stuffing exposes 6.9M users' ancestry data

Source: https://pwn.watch/i/23andme-credential-stuffing-data-breach-2023 · status: closed (closed Dec 4, 2023) · severity: high · updated Dec 4, 2023

## Patch status
**NO FIX NEEDED: no action on your side beyond verification.**

## What it is
Attackers used reused passwords to log into about 14,000 23andMe accounts, then scraped the DNA Relatives profiles those accounts could see. Data on about 6.9 million people was exposed and sold on hacking forums.

Severity detail: Data breach via credential stuffing

- Product: 23andMe

## Affected versions
- Not specified in the data. Check the advisories below.

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
No fixed version is listed. Follow the vendor advisory below.

## Secrets to rotate
This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs.

## Latest updates
- Dec 4, 2023: 23andMe confirms about 6.9 million people affected
- Oct 6, 2023: 23andMe confirms user profile data was scraped and offered on hacking forums

## Advisories
- [Addressing Data Security Concerns](https://blog.23andme.com/articles/addressing-data-security-concerns) (23andMe)

## Write-ups & news
- [23andMe confirms hackers stole ancestry data on 6.9 million users](https://techcrunch.com/2023/12/04/23andme-confirms-hackers-stole-ancestry-data-on-6-9-million-users/)

---
Machine-readable: https://pwn.watch/i/23andme-credential-stuffing-data-breach-2023.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.