Personal data, especially sensitive information like genetic data, is more valuable than ever in today’s digital environment. Genetic testing companies like 23andMe have built a large consumer base by offering insights into ancestry, health risks, and more. However, these platforms also store highly sensitive genetic information that can have severe repercussions if exposed. Such an incident was evident in October 2023, when 23andMe suffered a significant data breach that exposed millions of individuals’ personal and genetic information.
This breach affected those directly involved and set a precedent for the vulnerability of genetic data. This article explores the details of the 23andMe hack, the unique risks posed by genetic data breaches, and the broader implications of these incidents on privacy, security, and public trust in biotech companies.
In October 2023, 23andMe, a company that provides genetic testing for health and ancestry purposes, revealed that cybercriminals had accessed and stolen sensitive information from millions of users. While initial reports suggested that the breach primarily involved profile information, it later became apparent that genetic data was also compromised. The data totality included names, birth dates, genetic ancestry results, and even profile photos. For many, this hack was deeply unsettling, given the personal nature of the data involved.
The breach was reportedly part of a larger trend in targeted attacks on platforms that store sensitive information. While 23andMe has not disclosed the exact methods used by the hackers, many cybersecurity experts have pointed to a combination of social engineering techniques and vulnerabilities in the company’s security infrastructure.
Our law firm quickly filed a lawsuit on behalf of the affected individuals, accusing 23andMe of negligence in its data protection practices. The suit contends that the company failed to implement adequate security measures, putting millions of people at risk and delaying proper notification of the breach.
While financial data breaches are serious, the risks associated with genetic data breaches go far beyond identity theft or credit card fraud. Genetic information is permanent and reveals details about individuals, their family members, and future generations, making genetic data particularly valuable to cybercriminals.
Genetic data breaches invade privacy, creating one of the most pressing issues in this field. An individual’s genetic information reveals their ancestry, health risks, and potential future diseases. Many fear the exposure of their personal health information and the unintended use of this data.
For example, imagine an employer gaining access to an individual’s genetic information and learning about a predisposition to a costly medical condition. Despite protections like the Genetic Information Nondiscrimination Act (GINA) in the U.S., which prevents health insurance companies from using genetic information to deny coverage, there are loopholes. GINA doesn’t cover life insurance, disability insurance, or long-term care insurance, leaving a significant gap where individuals could face discrimination based on their genetic makeup.
Another major concern is the familial aspect of genetic data. When an individual’s genetic information is exposed, it doesn’t just affect them. Their parents, siblings, and even children share significant portions of their genetic makeup, making them vulnerable, too. The exposure of one person’s data can lead to the unwarranted disclosure of entire family histories, creating the potential for future data misuse.
The theft of genetic data presents unique security challenges, especially as biometric authentication (like DNA and fingerprints) becomes more prevalent. A person’s genetic code is an unchangeable identifier, unlike a password or even a Social Security number, which you can replace after a breach. With genetic data in the hands of cybercriminals, the potential for identity theft becomes more complex and personal. For example, hackers can use or sell someone’s genetic profile to create synthetic identities or even falsify information for criminal purposes.
There’s also the potential for hackers to target individuals based on their genetic vulnerabilities. For instance, people with genetic predispositions to certain diseases or conditions might find themselves the target of specific scams, such as fraudulent medical treatments.
Genetic data can be used in ways most people haven’t considered. For example, employers or insurance companies could use this information to make hiring or coverage decisions based on a person’s genetic predisposition to diseases or other health conditions. While GINA provides some protection against discrimination based on genetic information in employment and health insurance, it does not cover all forms of insurance, such as life or disability insurance.
A significant consequence of the 23andMe breach is the potential for genetic discrimination. There’s no way to undo that exposure when sensitive genetic information becomes publicly available. Individuals might face bias when applying for jobs or insurance policies if their genetic profile suggests a higher likelihood of developing expensive medical conditions. This fear of discrimination is compounded by genetic data containing information about family members, meaning that even a breach could indirectly affect relatives.
The 23andMe hack has broader implications for the biotech and health data industries. Companies that handle sensitive data, mainly genetic information, must maintain the highest security levels to protect their customers’ privacy. However, the 23andMe incident has highlighted gaps in the industry’s ability to safeguard this data, which could lead to a growing distrust of these companies.
As more consumers become aware of the risks associated with storing their genetic data with private companies, public sentiment may shift, with people choosing to forgo the insights these tests offer to protect their privacy. This is especially likely if more breaches occur or there are no significant advancements in data security. It also underscores the importance of regulatory oversight and transparency from companies that handle sensitive genetic data.
The 23andMe breach is a stark reminder that companies must go beyond the minimum to protect the data they store. Here are several key lessons that both consumers and companies should take away from this incident:
Companies that handle genetic data must adopt cutting-edge security protocols to prevent unauthorized access. Encryption, secure storage systems, multi-factor authentication, and regular vulnerability assessments are critical for safeguarding genetic information. In the case of 23andMe, the breach demonstrated that companies with substantial resources can still fall short of protecting their customers’ data if they do not take cybersecurity seriously enough.
One of the biggest criticisms against 23andMe in the breach’s aftermath was its slow response in notifying affected users. In data breaches, time is of the essence. Consumers need to be informed as quickly as possible so they can take steps to protect themselves. Delayed notifications can lead to more extensive damage as hackers have more time to exploit stolen information before individuals can act.
Governments and regulatory bodies must ensure that companies handling genetic data comply with stringent security standards. Current regulations, such as the Health Insurance Portability and Accountability Act (HIPAA), focus on healthcare providers, but they also must adequately address companies like 23andMe. Stronger regulations are needed to protect consumers, and they should include clear guidelines on how companies must respond to breaches.
While genetic testing offers exciting opportunities for individuals to learn about their ancestry and health risks, consumers must be fully aware of the risks involved. Before handing over their genetic information, individuals should consider the potential consequences of a breach and weigh those against the benefits. Companies should be transparent about how they handle data and what steps they take to protect it.
The class action lawsuit Cole & Van Note filed against 23andMe serves as an essential reminder of the power legal action holds in holding companies accountable for data breaches. Class action suits allow large groups of affected individuals to band together and seek justice, even when they might not have the resources to pursue individual claims.
For 23andMe, this lawsuit could result in substantial financial consequences. But more importantly, it could set a precedent for how companies must handle genetic data in the future. Companies that fail to protect their customers’ data could face significant legal liabilities, and the financial damages from these lawsuits could serve as a deterrent to lax security practices.
As genetic testing becomes more widespread, protecting this data becomes increasingly urgent. The 23andMe data breach exposed serious gaps in how sensitive genetic information is stored and protected. This incident should serve as a cautionary tale for consumers about the risks involved in sharing personal data with private companies. For businesses, it underscores the importance of going above and beyond regarding cybersecurity, particularly when handling such sensitive information.
If you’ve been affected by the 23andMe breach or other data breaches, it’s essential to understand your rights. Cole & Van Note is committed to protecting the interests of those affected by data breaches, helping victims hold companies accountable, and ensuring they receive the justice they deserve.
Published On: February 15, 2025.
