23andMe, Inc.

What the regulator decided

Credential-stuffing attackers reused passwords from unrelated breaches to log into 23andMe accounts and, via the DNA-Relatives feature, exfiltrated the genetic and personal data of around 155,592 UK users; 23andMe had not mandated multi-factor authentication, took four days to shut compromised accounts and force resets, and notified the ICO ten days late, breaching Articles 5(1)(f), 32(1) and 33(1) UK GDPR.

ConsentMark interpretation

Operator-readable note on how this case shapes the ConsentMark scanner narrative. Not a legal opinion; cites the primary source.

EUR amount approximate. Joint enforcement with the Office of the Privacy Commissioner of Canada. Cite when a scanner finds a high- sensitivity service (genetics, health, financial) without mandatory MFA and without compromised-credential checking - the ICO frames optional MFA on a high-risk service as a 32(1) breach.