Genetic testing company 23andMe has agreed to a $30 million settlement after a data breach exposed the personal information of approximately 6.9 million customers. The breach, which went undetected for five months, compromised users’ names, birth years, genders, ancestry reports, and raw genotype data, with hackers specifically focusing on customers of Chinese and Ashkenazi Jewish descent.
U.S. intelligence agencies recently identified foreign actors, particularly Russia and China, as key perpetrators behind multiple sophisticated cyber threats targeting critical infrastructure and personal information in the United States.
The hacker has only been identified as “Golem,” and shared victims’ personal information on an online forum used by cybercriminals, The New York Times reported.
As a part of the settlement, 23andMe will compensate affected customers and provide free access to a security monitoring program for three years. The company expects cyber insurance to cover $25 million of the $30 million total settlement.
23andMe said it will conduct annual cybersecurity audits and maintain a dedicated data breach incident response plan. The company is also ceasing to store personal information for inactive or deactivated accounts to minimize data retention risks.
The genetic testing company denies any wrongdoing and the settlement is still pending approval by a judge.
