Lack of appropriate safeguards led to 23andMe data breach, joint investigation finds

By Canadian Press on June 17, 2025.

OTTAWA — Canada’s privacy watchdog says inadequate security measures opened the door to a data breach discovered two years ago at genetic testing company 23andMe.

Privacy commissioner Philippe Dufresne and U.K. information commissioner John Edwards released the findings from their joint investigation of the breach, which affected almost seven million people, including nearly 320,000 in Canada.

Dufresne told a news conference today the breach serves as a cautionary tale for all organizations about the importance of data protection in an era of growing cyberthreats.

He says strong protection must be a priority for organizations, especially those holding sensitive personal information.

23andMe, which filed for bankruptcy in March, sells testing kits that use a customer’s saliva sample to uncover genetic information through DNA analysis, including details about health, ancestry and biological relationships.

Dufresne and Edwards announced last May they would look into the data breach’s scope, the company’s data handling safeguards and whether it adequately notified regulators and affected individuals about the lapse.

This report by The Canadian Press was first published June 17, 2025.

Jim Bronskill, The Canadian Press