What Happened to 23andMe User Data
In late 2023, 23andMe disclosed a credential-stuffing incident that exposed data for about 6.9 million users, according to the company's breach notifications and SEC filings. The compromised data included ancestry reports, DNA relatives matches, and profile details, with some users' raw genetic files also affected. 23andMe stated it notified impacted customers and reset affected credentials, and the incident drew scrutiny from regulators and privacy advocates. For a timeline of disclosures and company statements, see the 23andMe blog post on the incident.
The breach highlighted how genetic data can be targeted because it is immutable and uniquely identifying compared with passwords or tokens. Security researchers noted that reused credentials from other services enabled access, underscoring the importance of strong authentication and monitoring across accounts that store sensitive biological data.
Risks of Keeping Genetic Data With 23andMe
Keeping DNA data on a third-party platform creates exposure to future breaches, insider misuse, law-enforcement requests, and changes in company ownership or policy. 23andMe has shared data with pharmaceutical partners and research organizations under consent agreements, and users can review current data-sharing settings in their accounts. The company's privacy policy describes how genetic and profile information may be used, including for research and product development.
Law Enforcement and Research Sharing
23andMe has stated it complies with valid legal requests and has disclosed that it has received and responded to law-enforcement demands for user data. The company also offers options for users to participate in research studies, and users can manage consent through their privacy settings. For details on law-enforcement disclosures and research programs, see 23andMe's privacy policy page.
How to Delete 23andMe Data
23andMe provides a self-service account deletion option that permanently removes user data from its systems, subject to legal retention requirements and backup cycles. Users can initiate deletion from the account settings, and the company states that the process is immediate for active accounts, though some residual copies may persist in backups until they are rotated. For step-by-step instructions, see the 23andMe help center article on account deletion.
Before You Delete
Before deleting, users should download any raw DNA data files, ancestry reports, or relative matches they want to keep, because deletion is irreversible. Consider reviewing third-party connections, research consent, and data-sharing settings to minimize exposure before removing the account. For broader guidance on managing genetic privacy, see resources from the Federal Trade Commission on protecting personal health information.