The United Kingdom and Canada privacy watchdogs announced a joint investigation this week to determine the security lapses in the genetic testing company 23andMe’s October data breach, which leaked ancestry data of 6.9 million individuals worldwide.
The UK Information Commissioner John Edwards and Privacy Commissioner of Canada Philippe Dufresne will lead the investigation, pooling the resources and expertise of their respective offices.
Focus of 23andMe Data Breach Investigation
The joint investigation will examine three key aspects:
- Scope of Information Exposed: The breadth of data affected by the breach and the potential harm to individuals arising from it.
- Security Measures: Evaluate whether 23andMe had adequate safeguards to protect the sensitive information under its control.
- Breach Notification: Review whether the company provided timely and adequate notification to the regulators and affected individuals, as mandated by Canadian (PIPEDA) and UK (GDPR) data protection laws.
Edwards said the investigation was needed to garner the trust of people in organizations that handle sensitive personal data. He stated:
“People need to trust that any organization handling their most sensitive personal information has the appropriate security and safeguards in place. This data breach had an international impact, and we look forward to collaborating with our Canadian counterparts to ensure the personal information of people in the UK is protected.”
Dufresne on the other hand stated the risks associated with genetic information in the wrong hands. He said:
“In the wrong hands, an individual’s genetic information could be misused for surveillance or discrimination. Ensuring that personal information is adequately protected against attacks by malicious actors is an important focus for privacy authorities in Canada and around the world.”
The data protection and privacy laws in the UK and Canada allow such joint investigations on matters that impact both jurisdictions. “This investigation is a high priority for both offices and the aim is to complete the investigation as expeditiously as possible,” a spokesperson for the Office of the Privacy Commissioner of Canada told The Cyber Express.
The spokesperson further detailed that the UK’s ICO has specific responsibilities set out in the Data Protection Act 2018 (DPA2018) and under the General Data Protection Regulation (UK GDPR). Similarly, the OPC of Canada oversees compliance with the Privacy Act, which covers the personal information-handling practices of federal government departments and agencies, and the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada’s federal private-sector privacy law.
“Each regulator will investigate compliance with the law that it oversees,” the Spokesperson said.
“The OPC is mandated to conduct independent and impartial investigations into complaints involving businesses subject to PIPEDA. The Privacy Commissioner of Canada has the power to initiate a complaint when he believes that there are reasonable grounds to investigate.”
When asked about minimum penalties or fines that the genetic testing company 23andMe could be liable if any violations are observed, the spokesperson said Under PIPEDA, the OPC does not have the power to make orders or issue fines. The OPC can only pursue the matter in a Federal Court upon completion of the investigation.
“Given that the investigation is ongoing, it is premature to say what could be the repercussions. Each privacy authority will investigate compliance with the law it oversees to make a determination and determine next steps.”
“No further comment will be made while the investigation is ongoing,” the UK ICO said.
23andMe acknowledges the joint investigation announced by the Privacy Commissioner of Canada and the UK Information Commissioner today.
“We intend to cooperate with these regulators’ reasonable requests relating to the credential stuffing attack discovered in October 2023,” a 23andMe spokesperson told The Cyber Express.
Genetic Testing Company 23andMe Data Breach Timeline
23andMe first disclosed details of the October data breach in an 8-K filing with the U.S. Securities and Exchange Commission. The genetic testing company said attackers scraped profiles of 23andMe users who opted in to using the company’s DNA Relatives feature. This profiling feature connects users with genetic distant relatives – or other 23andMe users who share their bits of DNA.
The attackers used credential stuffing attacks that affected 0.1% of user accounts, the company told SEC. Using these accounts as a launchpad, hackers were able to access “a significant number of files containing profile information about other users’ ancestry.”
Threat actors claimed on underground forums that they were able to siphon “20 million pieces of code” from 23andMe. The claimed data set included information DNA ancestry backgrounds belonging to more than 1.3 million Ashkenazi Jewish and Chinese users.
By the end of October, another threat actor claimed compromise of 4 million genetic profiles, which the company also investigated. The genetic testing company 23andMe said it notified the affected 6.9 million users – 5.5 million DNA Relatives profiles and 1.4 million Family Tree profile – in December.
The company told federal regulators that the data breach incident was set to incur between $1 million and $2 million in one-time expenses.
The company faces at least 30 class action lawsuits in U.S.state and federal jurisdictions as well as in Canada.
23andMe blamed the customers’ poor security hygiene for the breach and has since made two-step verification a prerequisite for account logon. It also mandated customers to reset their passwords.
*Update 1 (June 12 – 12:00 AM EST): Added response from the 23andMe spokesperson.
*Update 2 (June 13 – 04:30 AM EST): Added response from the spokesperson of the Office of the Privacy Commissioner of Canada.
