Investigation underway into data breach at genomics company
The gene-testing company located in Silicon Valley is under investigation by the UK information commissioner for holding ‘highly sensitive information’ from customers worldwide.
An investigation has been launched by the UK data commissioner, along with its Canadian counterpart, into a 2023 hack of “highly sensitive information” stored by the gene testing company, 23 and Me.
Based in San Francisco, the biotech company sells its testing kits globally, enabling consumers to explore their ancestry and genetic traits by sending a saliva sample through the mail.
In October 2023, hackers managed to access the extremely personal information of approximately seven million customers and attempted to sell it on the dark web.
The investigation will also determine whether the company adequately notified the two regulators and affected customers about the breach, as required by data protection laws in both the UK and Canada.
John Edwards, the UK Information Commissioner, stated, “People should be able to trust that any organization handling their most sensitive personal information has the necessary security measures in place.”
Related Stories
“Given the international impact of this data breach, we are eager to collaborate with our Canadian counterparts to ensure the personal information of individuals in the UK is safeguarded,” Edwards added.
Privacy Commissioner of Canada, Philippe Dufresne, expressed concerns about potential misuse of individuals’ genetic information and emphasized the importance of protecting personal data against malicious attacks.
Following the breach, 23 and Me has implemented enhanced security measures, such as requiring two-factor authentication for all users.
According to their website, the company has sold over 12 million DNA kits since 2006, priced between approximately £79 for ancestry-only kits and up to £239 for health and ancestral trait kits, with an optional annual subscription for updates.
The company stated, “23andMe acknowledges the joint investigation initiated by the privacy commissioner of Canada and the UK information commissioner today.”
Potential For Misuse
The company’s website has a dedicated section on “Privacy,” where customers are informed that they can choose whether their saliva sample is retained for research or safely discarded after processing.
The company, founded in 2006, began selling kits in the UK in 2008, offering home kits that reveal both ancestral and health traits to consumers.
Concerns about privacy and the potential misuse of DNA have been raised in the media, with stories of customers discovering unexpected information through tests, such as finding out their biological parent is different from who they thought, or learning about increased risks of serious illnesses like Alzheimer’s and certain cancers due to their genetic makeup.
Due to the extensive genetic mapping capabilities of the test, concerns have also been raised about the possibility of genetic discrimination for insurance purposes.
Partnership With Pharmaceutical Giant
In July 25, 2018, 23andMe announced a partnership with GSK (GlaxoSmithKline) to use the test results from five million customers to develop new drugs. This partnership led to a $300 million investment from GSK, and it was extended until July 2023 with an additional $50 million payment.
