23andMe agrees to $30 million settlement after major data breach

LAUREN TAYLOR: GENETIC TESTING COMPANY, 23ANDME, HAS AGREED TO A $30 MILLION SETTLEMENT FOLLOWING A DATA BREACH THAT EXPOSED PERSONAL INFORMATION OF APPROXIMATELY 6.9 MILLION CUSTOMERS.

THE BREACH, WHICH WENT UNDETECTED FOR FIVE MONTHS, COMPROMISED
USERS’ NAMES, BIRTH YEARS, GENDERS, ANCESTRY REPORTS, AND RAW GENOTYPE DATA, WITH HACKERS SPECIFICALLY FOCUSING ON CUSTOMERS OF CHINESE AND ASHKENAZI JEWISH DESCENT.

U.S. INTELLIGENCE AGENCIES RECENTLY IDENTIFIED FOREIGN ACTORS, PARTICULARLY RUSSIA AND CHINA, AS KEY PERPETRATORS BEHIND MULTIPLE SOPHISTICATED CYBER THREATS TARGETING CRITICAL INFRASTRUCTURE AND PERSONAL INFORMATION IN THE UNITED STATES.

THE HACKER HAS ONLY BEEN IDENTIFIED AS “GOLEM” – AND SHARED VICTIMS PERSONAL INFORMATION ON AN ONLINE FORUM USED BY CYBERCRIMINALS, THE NEW YORK TIMES REPORTED.

AS A PART OF THE SETTLEMENT, 23ANDME WILL COMPENSATE AFFECTED CUSTOMERS AND PROVIDE FREE ACCESS TO A SECURITY MONITORING PROGRAM FOR THREE YEARS.

THE COMPANY EXPECTS CYBER INSURANCE TO COVER $25 MILLION OF THE $30 MILLION TOTAL SETTLEMENT.

23ANDME SAYS IT WILL CONDUCT ANNUAL CYBERSECURITY AUDITS AND MAINTAIN A DEDICATED DATA BREACH INCIDENT RESPONSE PLAN.

23ANDME IS CEASING TO STORE PERSONAL INFORMATION FOR INACTIVE OR DEACTIVATED ACCOUNTS TO MINIMIZE DATA RETENTION RISKS.

THE GENETIC TESTING COMPANY DENIES ANY WRONGDOING AND THE SETTLEMENT IS STILL PENDING APPROVAL BY A JUDGE.