Michael GirdleyGirdley Enterprises, Girdley Enterprises, Inc. · Business builder and investor

23andMe blamed users after 7 million records leaked

Name: 23andMe blamed users after 7 million records leaked
Uploaded: 2026-04-27T19:53:59+00:00
Duration: 1 min 51 s
Channel: Michael Girdley
Description: In a 2023 data breach, 23andMe’s DNA Relatives feature was exploited by a hacker who obtained passwords for roughly 14,000 accounts and used the feature…

27 Apr 2026 · 2 min

Watch on YouTube

1:51

In a 2023 data breach, 23andMe’s DNA Relatives feature was exploited by a hacker who obtained passwords for roughly 14,000 accounts and used the feature to download the genetic data of over 7 million users—more than half of the company’s database. The attacker focused on individuals of Ashkenazi Jewish and Chinese descent, publishing the data on dark‑web forums. Instead of acknowledging the design flaw, 23andMe’s legal team shifted blame onto users for weak passwords, arguing the breach was caused by the small subset of compromised accounts rather than the feature itself. Security experts and legal scholars countered that the DNA Relatives functionality was the root cause. The commentator argues that this blame‑shifting eroded consumer trust, leading to a rapid decline: the company eventually declared bankruptcy, its stock plummeted by 99.7%, and the incident highlighted the risks of storing highly personal DNA information. A longer‑form video on the company’s rise and fall is referenced in the comments.

Chapters

In 2023, genetic testing company 23andMe, that many of us know because we sent our spit off in a little tube to them, uh, was hacked, and over 7 million users' information was publicly disclosed. Normally, a company like this would come out and own it and say they were sorry for their part in allowing people's information to become public, but instead, 23andMe did something different. To be fair to 23andMe, the way the hacker did this was actually pretty interesting. He used a feature that 23andMe had created which allowed people to view potential ancestors of theirs and their relatives' data through their accounts. So by only getting the passwords for 14,000 out of the 14 million people in the database, he was able to access over half of the records, 7 million of them, in the 23andMe database. Made worse is that this person did a lot of this with a racial bias. He specifically targeted Ashkenazi Jews and people of Chinese descent, and then he published that stuff on dark web forums. But next, 23andMe, instead of acknowledging their part in the whole problem, used their lawyers basically to blame the users and say, hey, it wasn't the feature we added, this DNA relatives feature, it was the 14,000 people who hadn't changed their password. Security experts and legal scholars would basically point out the obvious, which was that the feature DNA relatives was what had caused this problem, not the 0.1% of their users who had had dumb passwords. Many companies like 23andMe are built entirely on consumer trust, like Arthur Andersen and folks like that that have blown up because they basically gave up trust with their customers, 23andMe went down the same path. Within a few years, they would declare bankruptcy and the stock would be down 99.7% and the whole thing would crater. And this was made all the worse that they were holding people's very most personal information, which is their DNA. If you're interested, I did a long-form video on this topic of 23andMe and its rise and fall. If you'd like, there's a link to the long-form video in the comments below. Catch you next time.