In 2023, 23andMe experienced a significant data breach involving information accessed through its DNA Relatives feature. The incident exposed highly sensitive personal information relating to millions of customers and, in some cases, their relatives.
KP Law is investigating potential claims arising from the breach and represents individuals affected by the incident.
23andMe is a genetic testing and ancestry company that holds highly sensitive personal and genetic information about its customers.
In October 2023, 23andMe confirmed that unauthorised individuals had accessed customer accounts and information through its DNA Relatives feature. The compromised data includes:
Other sensitive information could also be affected.
23andMe also stores genetic information about the relatives of some of its users. So even if these relatives didn’t send a sample or consent to any data collection, they could also be involved in this privacy violation.
Following the breach, the hackers are offering the assembled genetic information of thousands of people for sale on the dark web.
KP Law is investigating this incident, and we are considering a no-win, no-fee group action claim to help victims living in England & Wales claim compensation.
“The 23andMe data breach is particularly concerning because of the highly sensitive nature of genetic and ancestry information involved. Our focus is on establishing whether the appropriate safeguards were in place, and what legal remedies may be available to those affected.”
Kingsley Hayes | Partner & Head of Data & Privacy Litigation
At KP Law, we represent clients in group actions with the innovation, resources and expertise needed to take on complex cases. Our GDPR, data breach and cybercrime specialists have more than 50 years of combined experience, making us one of the most experienced multi-claimant law firms in the UK. Working alongside leading barristers and legal experts, we provide the highest standard of support while leveraging the resources and global expertise required to pursue challenging claims successfully. With offices in London, Liverpool, Manchester and Birmingham, supported by technology that enables us to serve clients across England and Wales, we combine national reach with a modern, client-focused approach. By using innovative technology, operating on a no-win, no-fee basis, and keeping the process straightforward and hassle-free, we make accessing expert legal representation as simple as possible.
According to the company, hackers may have used credentials leaked from other websites to breach 23andMe accounts – a technique known as ‘credential stuffing’.
The compromised data includes:
Other sensitive information could also be affected.
In an email to affected it users, 23andMe said:
“We are working with third-party forensic experts on this investigation, as well as federal law enforcement. We have also required all customers to reset their passwords. Security and privacy are the highest priorities at 23andMe. We exceed industry data protection standards and have achieved three different ISO certifications to demonstrate the strength of our security program. We actively and routinely monitor and audit our systems to ensure that your data is protected. When we receive information through those processes or from other sources claiming customer data has been accessed by unauthorized individuals, we immediately investigate to validate whether this information is accurate. Beginning in 2019, we’ve offered and encouraged users to use multi-factor authentication (MFA), which provides an extra layer of security and can prevent bad actors from accessing an account through recycled passwords.”
23andMe has also advised users change their login information and enable two-factor authentication to keep their accounts secure. 23andMe has not offered victims any credit monitoring or identity protections following the breach.
23andMe should be in touch to notify affected individuals.
Anyone who thinks they might be involved should take immediate steps to protect themselves. Find out how to do this here.
If you live in England or Wales and you are involved in this breach, you may be able to join our no-win, no-fee compensation claim. There are no costs to register and no obligation to proceed.
A group action claim is where a group of people – sometimes even thousands of people – have been affected by the same issue. Group action cases are also known as class actions, multi-claimant, or multi-party actions
If we do launch a group action, there are no costs to join a claim. However, if your claim is successful, you may have to pay a ‘success fee’. This fee is taken from the compensation awarded to you. At KP Law, our success fee is competitive, and we make sure you are fully informed about any potential costs before you officially join our action. If you lose, you won’t have to pay a penny.
Arnold Clark customers had their personal information compromised after hackers broke into the car dealer’s systems. Tens of thousands of people are thought to be at risk. According to reports, the stolen data includes: Bank account and sort code details may also have also been stolen. At KP Law, we
Associate Bill Singer has commented on the ongoing Arnold Clark data breach claim and the fraud risks to those impacted in Computer Weekly. Bill’s comments were published in Computer Weekly, 13 June 2023, and can be read here. Bill said that frauds linked to the Arnold Clark breach are appearing all
Associate solicitor in our Data Breach team, Bill Singer, has commented in Car Dealer Magazine detailing the extent and severity of Arnold Clark customer data which has been exposed on the dark web.
“Used KP Law for a group data breach compensation claim. I was kept updated throughout the process. The whole thing was easy with no stress.” – Anon
“I used the firm as part of a group action following a, potentially, hazardous data breach. From the very start, I was kept updated regarding the other side’s actions and what the counter actions were. I found KP to be trustworthy, knowledgeable and very customer friendly.” – Pat
“I used KP Law for the first time for a data breach group compensation claim. From outset to conclusion I was kept fully informed and received clear, regular updates throughout. I would not hesitate to recommend them and would chose them in any future action.” – Owen
By not putting adequate processes and training in place, organisations are leaving customers open to an increased risk of cyber scams and avoidable mistakes that lead to data breaches. If you are a victim of a data protection failure, check out our current group actions below to see if we are running a claim related to that specific breach.
Unsure if your personal data has been exposed in a breach? Learn how to check and what steps to take, including your right to join a group claim in the UK.
At KP Law, our expert data breach lawyers want to lessen the impact of a data violation as much as possible. To help, we have collated a range of support, information and other resources to help you get your life back on track.
