Genetic testing firm 23andMe faces large fine for failing to protect customer data
Genetic testing company 23andMe failed to take basic steps to protect customer data, according to a joint investigation by Canada and the U.K. into a massive global data breach that resulted in information from nearly seven million people being posted for sale online.
As a result, the U.K. is imposing a £2.31 million (C$4.24 million) fine on the company. Canada does not have the power to impose a similar penalty under current privacy laws.
Canada's privacy commissioner Philippe Dufresne and U.K. information commissioner John Edwards revealed their findings at a news conference in Ottawa on Tuesday morning.
'With data breaches growing in severity and complexity, and ransomware and malware attacks rising sharply, any organization that is not taking steps to prioritize data protection and address these threats is increasingly vulnerable,' Dufresne said on Tuesday. 'Our investigation found that these types of security measures were not in place at 23andMe.'
In September, 23andMe agreed to pay US$30 million to settle a lawsuit after hackers accessed the personal data of 6.9 million customers and posted their information for sale on the dark web, including data from nearly 320,000 people in Canada and more than 150,000 people in the U.K. The 2023 attack appeared to specifically target customers with Chinese and Ashkenazi Jewish ancestry.
'The compromised data included highly sensitive information related to health, race and ethnicity information as well as information about relatives, date of birth, sex at birth and gender,' Dufresne explained. 'Much of this information was derived from individuals' DNA. The breach serves as a cautionary tale for all organizations about the importance of data protection in an era of growing cyber threats.'
The joint investigation by privacy authorities in Canada and the U.K. was launched in June 2024 to examine the scope of the breach and 23andMe's response.
'In the wrong hands, an individual's genetic information could be misused for surveillance or discrimination,' Dufresne said in a news release when the investigation was announced. 'Ensuring that personal information is adequately protected against attacks by malicious actors is an important focus for privacy authorities in Canada and around the world.'
23andMe filed for bankruptcy in March. On June 13, it was announced that a non-profit led by 23andMe co-founder Anne Wojcicki would purchase the troubled company for US$305 million.
Founded in 2006, 23andMe claims to have more than 15 million customers worldwide. The business was centred on at-home DNA testing kits that use saliva samples to provide genetic insights about health risks and ancestry. The California-based company went public in 2021, but never made a profit.
'23AndMe failed to take basic steps to protect people's information,' Edwards said at the press conference on Tuesday. 'Their security systems were inadequate, the warning signs were there and the company was slow to respond. This left people's most sensitive personal data vulnerable to exploitation and harm.'
The investigation also found that 23andMe did not adequately notify regulators and affected customers of the breach as required by Canadian and U.K. laws. Dufresne said they were concerned to find the stolen data was later offered for sale online.
'Strong data protection must be a priority for organizations, especially those that are holding sensitive personal information,' Dufresne said. 'Organizations must also take proactive steps to protect against cyberattacks. This includes using multi-factor authentication, strong minimum password requirements, compromised password checks, and adequate monitoring to detect abnormal activity.'
Dufresne also called for modernized privacy laws in Canada that would allow him to issue fines and orders like his counterpart in the U.K.
'This is something that exists broadly around the world in privacy authorities and it is something that is necessary,' Dufresne said. 'You can see in a case like this in terms of cybersecurity, in terms of things where time is of the essence, where there are real consequence, this is a gap.'
In a statement to CTV News, a 23andMe spokesperson said by the end of 2024 the company 'had implemented multiple steps to increase security to protect individual accounts and information.' 23andMe's new owner, they added, has 'made several binding commitments to enhance protections for customer data and privacy,' including allowing users to delete their accounts and opt out of having their information used for research.
23andMe saliva collection kit
A 23andMe saliva collection kit is shown on March 25, 2025, in Oakland, Calif. (AP Photo/Barbara Ortutay)
With files from Reuters and CNN
Hashtags
Try Our AI Features
Explore what Daily8 AI can do for you:
Comments
No comments yet...
Related Articles
Cision Canada
25 minutes ago
- Cision Canada
MEDIA ADVISORY - Unifor National President available to comment on Canada-U.S. trade deal deadline
TORONTO, July 31, 2025 /CNW/ - Unifor National President Lana Payne will be available Friday, August 1August 1 Canada-U.S. trade deal deadline. As the trade deal deadline looms, Unifor continues to push for a deal with the U.S. that protects Canadian jobs, workers, and industries For media inquiries or to arrange interviews with Unifor National President Lana Payne via Zoom, Facetime, and Microsoft Teams please contact Unifor Communications Representative Paul Whyte at [email protected]. About Unifor Unifor is Canada's largest union in the private sector and represents 320,000 workers in every major area of the economy. The union advocates for all working people and their rights, fights for equality and social justice in Canada and abroad, and strives to create progressive change for a better future.
National Post
25 minutes ago
- National Post
Jamie Sarkonak: It shouldn't take 16 years to deport a foreign criminal
Article content He also feared that India wouldn't issue him a passport to allow him to see his children. Finally, he made the thin suggestion that he might face harassment in India for claiming asylum abroad — there was no 'assurance' that he would not be persecuted there, he claimed. Article content Try as he did, none of his concerns met the legal test to halt his imminent deportation, and Judge Phuong Ngo — who came to Canada as a legitimate refugee when she was a child — ordered him deported. Whether he's actually in India, we don't know. The CBSA won't comment on individual cases. Article content It's possible that he's still here: aside from uncooperative foreign countries and individuals, the CBSA told the Post that other 'impediments to removal' exist, such as 'the inability to use commercial airlines due to their lack of flights to certain destinations, their limits on the number of deportees per flight or refusal to transport foreign nationals with criminality.' Article content Uncooperative foreign governments are a recurring problem. Right now, probably still locked up in a CBSA detention facility is Somali national Lahi Abdi, who came to Canada in 2003 and has committed many serious crimes here since, including assault with a weapon, robbery, gun offences, drug offences and, of course, court-order breaches. Deportation proceedings finally commenced in 2017, and he was ordered deported in 2020. He wasn't removed from the country, however, and went on to commit more gun crimes in 2021. He was finally jailed by the CBSA in 2022. Article content Article content Abdi tried to have the Federal Court release him in 2024, but was denied. The decision rejecting his bid notes that CBSA officials have tried since 2023 to have Somali officials provide the appropriate travel documents, to no avail. Thus, his care was left to Canadian taxpayers. Article content Ankit Kundu, a work- and study-permit holder from India, got here in 2016 and, by 2019, was convicted of sexual interference against an underage girl. He was ordered deported that year, but he continued to live in Canada, using administrative levers to stall his removal. 'Between 2021 and 2023, the CBSA was unable to remove the applicant due to a lack of proper travel documentation,' notes a Federal Court decision that green-lit his scheduled January 2024 deportation. It's not clear whether Kundu was the uncooperative party in this case, or India. Article content This is the Canadian system working on autopilot. An endless series of processes set out by careless legislators allows convicted criminals repeated kicks at the can, and when foreign countries refuse to co-operate with our border officials, we sit back and let it happen. Article content Article content It doesn't have to be this way. If countries refuse to co-operate when we exercise our sovereign rights, they should face consequences. If, say, Pakistan is causing problems in this regard, Canada should refuse to issue visas to its travellers until it can cough up the travel documents we need. Public statements should be made by the public safety minister (hopefully a future, competent one who hasn't tried to help an admitted terrorist immigrate to Canada). Article content We could use some transparency, too: the CBSA should have an outstanding-travel-document dashboard on its website for all to see. It should also be obligated to confirm whether a particular deportee has actually been sent home. Article content The CBSA could be staffed to the brim with the greatest officers in the country, but it wouldn't change the high-level issue here: the agency is constrained by the meekness of its minister, and by Parliament via Canadian immigration laws — laws that support endless 'due process' for foreign criminals at the expense of public safety. Article content
National Post
25 minutes ago
- National Post
Ontario court upholds sex assault sentence for man who removed condom
Article content The trial judge found that M.F. had not heard Ranatunga say he was removing the condom and that there was no ambient noise in the bedroom that would have impaired her hearing. The trial judge also rejected Ranatunga's argument that he had an 'honest but mistaken' belief that M.F. had consented to unprotected sex. Article content At the sentencing hearing, the Crown sought a three-year penitentiary sentence, and the defence submitted that a conditional sentence of 18 months to two years less a day was appropriate or a sentence of imprisonment between 12 and 18 months to be served in a reformatory. Article content In the end, the trail judge sentenced the respondent to a conditional sentence of two years less a day, finding that he was a first-time offender with good rehabilitative prospects. Article content The trial judge found that removing a condom without consent is a 'form of violence' and an 'extremely serious violation,' but found that removing a condom is 'qualitatively different in nature than a sexual assault which involves physically holding a person down against their will and penetrating them or penetrating them when they are in a state where they could not resist; for example, sleeping or intoxicated'. Article content The Crown appealed the case, arguing that the sentence was unfit and that the judge did not appropriately consider the violent nature of the offence. Article content Gillese objected strongly to the trial judge's reasoning. 'There is no principled basis to distinguish penetration following non-consensual condom removal from other forms of penetrative sexual assault nor is there any principled basis for creating a much lower sentencing range for non-consensual condom removal sexual assault than that for other forms of penetrative sexual assault,' she wrote. Article content She argued that forced penetrative sexual assault typically calls for three to five years behind bars. Article content However, the other two justices disagreed, saying the trial judge had intended to contrast sexual assault cases with overt force or incapacitation and that the trial judge was owed deference in her decision within the changing legal landscape of these sorts of sexual assault cases. Article content The decision builds on the Supreme Court's 2022 ruling in R. v. Kirkpatrick, which clarified how condom use factors into sexual consent under Canadian law. In that case, the court found that a person can place conditions on their consent, and if those conditions aren't met, the sexual activity becomes non-consensual. Article content
