Fourteen thousand accounts, 6.9 million people: the 23andMe ratio every health data platform should measure

The week

On October 6, 2023, the consumer genetic testing company 23andMe confirmed that user profile information had been compiled from its platform and offered for sale online. 23andMe sells mail-in DNA kits: customers spit in a tube, and the company returns reports on ancestry and traits.

Many of its customers learned that week that their name, birth year and family ancestry were for sale although they had done nothing wrong. Someone else, often a distant cousin they had never met, had reused an old password.

The trail had started a few days earlier. According to the company’s amended SEC filing, a threat actor posted a claim online on October 1 to hold 23andMe users’ profile information. The company’s first public statement followed on October 6. It said there was no sign that its own systems had been breached, and it urged customers to choose strong, unique passwords and turn on multi-factor authentication.

The company said the attackers had not broken through its walls in the dramatic way people imagine. They had signed in to customer accounts with passwords reused from other breaches, a technique known as credential stuffing. Because many people use the same email and password on several sites, a list leaked from one company opens accounts at another.

Once inside, the attackers used the opt-in DNA Relatives feature. It lets customers who share stretches of DNA find one another and see what each has chosen to share. Through it, the attackers could view what matched relatives had made available, such as names, birth years, relationship labels, ancestry reports and in some cases location. Early listings were reported to single out users of particular ancestries, which turned a privacy problem into something more menacing.

The company had roughly 14 million customers at the time, by its own count. DNA Relatives was optional, but finding relatives is a large part of the appeal of an ancestry service. Customers who opted in had agreed to let their genetic matches see their profile. They had not agreed to let a stranger holding a match’s old password see it, and they had no way to tell the difference.

The response unfolded over the following weeks, and the company’s own update log records the sequence. On the evening of October 9 it said all customers would have to reset their passwords; its SEC filing dates that requirement to October 10. On October 20 it temporarily disabled some DNA Relatives features as a precaution. From November 6, email-based two-step verification became mandatory for all customers, new and existing.

Each step carried information for anyone reading closely. A forced password reset only matters if attackers might still hold working credentials. Switching off part of a sharing feature acknowledges that the feature, more than any single account, set the scale of the exposure. Mandatory two-step verification closed the door the attackers had used, a door that had been left to each customer’s choice until then.

The scale only became clear later. In a December filing with the SEC, 23andMe said about 0.1 percent of user accounts had been accessed directly. The company’s own update put that at roughly 14,000 accounts. The same update said about 5.5 million DNA Relatives profiles and 1.4 million Family Tree profiles, some 6.9 million in all, had been reached through those accounts.

That amended filing, dated December 1, estimated one-time costs of $1 million to $2 million, mostly for technology consultants, lawyers and other advisers. It also listed lawsuits already filed in federal and state courts in California, in Illinois state court, and in British Columbia and Ontario.

Investigators abroad later reconstructed what had come before that week. A joint inquiry by the United Kingdom’s Information Commissioner’s Office and the Office of the Privacy Commissioner of Canada found that credential stuffing against the platform began in April 2023. It was intense in May and came in another wave in September. In August, a claim that data on more than 10 million users had been stolen was dismissed as a hoax. Only in October, after an employee found the data advertised for sale on Reddit, did the company open a full investigation.

Set side by side, the numbers show the shape of the event. A small number of break-ins reached a very large number of people, almost all of whom never had their own password guessed. By then the company required two-step verification for all users, meaning a second proof of identity, such as a code sent to a phone or an email inbox, on top of the password.

Few health system executives would think of a consumer genetics company as a peer. But the arithmetic of that week applies to any platform where one person’s account can see other people’s information, and health care is full of them.

23andMe’s consumer service is not a HIPAA covered entity, and few health systems would call it a peer. The incident still carries a measurement that health systems can apply to their own platforms: the ratio between accounts an attacker controls and people whose data those accounts can see. At 23andMe the ratio was roughly 1 to 500. For every account the attackers opened, around five hundred people were exposed.

The 1-to-500 figure is a rough division: about 6.9 million profiles over about 14,000 accounts. A profile could be reached through more than one compromised account, so the division is approximate. What matters is the order of magnitude. An attacker who controlled one account in a thousand reached a large share of everyone who had opted in to the sharing feature.

A patient portal with proxy access, a research participant portal, or a care coordination app shared across organizations each has its own ratio, and few organizations have calculated it. Boards routinely see how many patients use the portal. Very few see how many people a single stolen portal login could reveal.

The ratio has three terms. The numerator is how easily an attacker takes over accounts. The multiplier is what each account can see about other people. The consequence is which rules protect the data once it is out. Some vocabulary comes first.

Passwords, proxies and the reach of HIPAA

Authentication is how a system decides you are who you say you are. For most consumer and patient platforms it still begins with a password. Passwords are weak less because they are easy to guess one at a time than because people reuse them, and because billions of old email and password pairs from past breaches circulate among criminals.

Credential stuffing exploits that reuse. An attacker loads a leaked list into automated software, which tries each pair against a target’s login page, often thousands of attempts a minute. The attempts are spread across many internet addresses so that no single source looks suspicious. Most attempts fail. A small fraction succeed, and at scale a small fraction is a lot of accounts. No clever hacking is needed, which is why the technique is so common.

Multi-factor authentication, often called MFA or two-step verification, adds a second proof beyond the password: a code from a text message or an app, a tap on a phone, or a physical key. It works because a leaked password alone is no longer enough. It is the single most effective defense against credential stuffing, and it also adds friction, which is why companies hesitate to require it.

Second factors are not equal. Codes sent by text message can be diverted through SIM swapping, in which a criminal persuades a phone carrier to move a number to a new card. Codes sent by email, the method 23andMe made mandatory, are only as safe as the email account. App-generated codes are stronger. Passkeys and hardware keys resist phishing outright. For a patient population, the right answer is usually a menu, with the strongest options pressed hardest on the accounts that can see the most.

Proxy access is the health care term for letting one person see another’s record: a parent viewing a child’s, an adult child helping an elderly parent, a caregiver managing appointments. It is a sharing feature, like DNA Relatives, built for good reasons.

HIPAA has its own term for part of this. A personal representative, such as the parent of a minor or a person holding a health care power of attorney, generally stands in the patient’s shoes for access rights. Portal proxy access is broader and looser. Many health systems also let patients grant access to adult relatives and caregivers who have no legal status at all. State laws on minors’ confidentiality, especially for reproductive, mental health and substance use care, carve exceptions out of parental access.

Two federal regimes push toward more sharing. HIPAA gives individuals a right of access to their own records. The information blocking rules under the 21st Century Cures Act, in effect since 2021, discourage providers and health IT developers from practices that interfere with access to and exchange of electronic health information. Both are sound policy. Both also mean a health system cannot shrink a multiplier simply by switching sharing off.

Finally, HIPAA, the federal health privacy law, protects health information held by specific kinds of organizations. It does not follow the data wherever it goes. That detail matters more than most executives realize, and we return to it below.

The numerator: how easily an attacker takes over accounts

Credential stuffing requires no skill. Attackers take username and password pairs leaked elsewhere and try them at scale, relying on reuse. Defenses are well known: multi-factor authentication, screening passwords against known breached lists, detection of automated login attempts, and rate limiting by device and network. Rate limiting means capping how many attempts can come from one device or network in a given period.

The attacker’s economics

Credential stuffing is cheap because nearly every input is free. Leaked combination lists circulate widely. Automation tools are available off the shelf. Residential proxy services route traffic through ordinary home connections, which defeats simple blocking by address. The attacker’s main cost is time, and a very low success rate still pays when the list holds millions of pairs.

Those economics point to the defender’s levers. Anything that raises the cost of each attempt, such as bot detection that forces slower and more convincing automation, cuts the yield. Anything that makes a correct password insufficient, such as a second factor, cuts the yield to almost nothing for protected accounts. Anything that shortens the campaign, such as an alert on a spike in failures, limits how many accounts the attacker harvests before the door closes.

In 2023 many consumer health services left multi-factor authentication optional because each added step lowered sign-ups and engagement. It was a commercial decision dressed up as a technical one.

Patient portals face the same pressure. Health systems want patients to message clinicians, view results and pay bills online, and portal use is often a tracked performance goal. Every extra screen at login costs some patients, particularly older ones or those with limited digital confidence. Authentication is therefore a trade-off that belongs with leadership rather than with the portal vendor’s default settings.

A reasonable baseline starts with breached-password screening for everyone and bot detection at the login page. Breached-password screening checks a new or existing password against lists of passwords known to have leaked and asks the patient to change it if there is a match. Bot detection looks for the telltale patterns of automated software, such as inhuman speed or identical behavior across thousands of sessions. Neither adds much friction for a genuine patient.

Screening does not require sending passwords anywhere. Common services compare a short fragment of a password’s cryptographic hash against a published list, so the full password never leaves the organization. NIST’s digital identity guidelines have recommended checking new passwords against lists of compromised values since 2017. Few patient portals did so by default in 2023.

Multi-factor authentication can be offered to all patients and required for proxies and sensitive actions. Changing a phone number or email address, the usual first move after a takeover, should trigger step-up verification, meaning an extra check at that moment even if the person is already signed in. An attacker who controls the contact details controls the password reset, and therefore the account.

The patient access team should report login failure spikes to security the same way the security team reports alerts. A sudden jump in failed logins is often the first visible sign of a credential stuffing campaign, and it frequently shows up first in the team responsible for portal support calls.

Measuring the numerator

The numerator can be measured. Useful figures include the share of active accounts with a second factor enrolled and the share of passwords found on breached lists at the last check. Two more are daily failed logins against a baseline, and the time between a spike starting and someone in security looking at it. Patient reports of takeover belong in the same view. They often arrive as complaints about messages the patient did not send or proxies the patient did not add.

Who can change the settings

The room to act differs by organization. A large academic health system usually runs its portal on its electronic health record vendor’s platform, with sign-in options set by configuration and sometimes delegated to an identity service the system controls. An ambulatory network or physician group may rent a portal from a practice management vendor and get only the settings that vendor exposes. A research institute may run a custom participant portal built for one grant. The question is the same in each case. The answer is a configuration change in the first, a contract negotiation in the second, and possibly a rebuild in the third.

The case against mandatory second factors

The argument against requiring multi-factor authentication for every patient is serious. Patients without smartphones, patients who share a phone with family and patients with cognitive impairment can be locked out. Lockouts generate calls, and calls cost money. Some patients will abandon the portal for phone and paper, which carry their own privacy risks. Those costs are reasons to target the requirement by multiplier and by action, and to fund an accessible recovery process. They do not justify leaving every account protected by a password alone.

Recovery is where many sign-in designs fail. If a patient who loses a phone can reset everything by answering questions anyone could research, the second factor protects little. Health systems already verify identity at registration desks, and some route high-risk recoveries through an in-person or video check. That is slower, and for an account with a large multiplier, slower is acceptable.

The multiplier: what one account can see

23andMe’s feature worked as designed. Each customer chose to share with matches, and each compromised account could therefore read many relatives’ shared profiles. The security of one person’s data depended on the password habits of hundreds of strangers, a risk no individual customer could manage for themselves.

Health systems build multipliers on purpose, because they serve patients well. Proxy access lets a parent, adult child or caregiver see another person’s record. Some research portals show participants information about cohorts or matched studies. Clinician-facing views in health information exchanges, the networks that let hospitals and clinics share records with one another, let one credential search across many organizations’ patients. Third-party apps connected through interoperability rules can pull a full record with one authorization. Interoperability here means the federal push for systems to exchange data through standard connections, so a patient can send their record to an app of their choice.

Multipliers measured in time

Connected apps change the arithmetic in a different way. Under federal interoperability rules, patients can direct their records to apps of their choice through standard interfaces, and one authorization can pull years of history. If a patient’s portal login is stolen, the attacker can authorize an app they control and export the record without paging through a single screen. Here the multiplier is speed: a full record can leave in seconds.

Health plans have a version of the same feature. Federal rules required Medicare Advantage organizations, Medicaid and CHIP programs, and certain plans on the federal exchanges to offer patient access interfaces for claims and clinical data. A subscriber’s member portal may also show claims for dependents on the same policy, subject to plan rules and, in some states, laws protecting adult dependents’ sensitive services. A payer’s multiplier is often hidden in the family plan.

Cross-organization exchange grew in the same period. Live exchange under TEFCA, the national framework that connects health information networks under common terms, began in December 2023. Depending on configuration and the permitted purpose, a clinician’s credential at one participating organization can query far beyond its home system. That is a clinical benefit, and it is also a multiplier that belongs on the list.

Each deserves the 23andMe question in writing: if this one account were controlled by an attacker, how many other people’s records could it see, and how fast could it read them?

Genetic data carries a multiplier of its own, whatever the features around it. A variant found in one patient says something about parents, siblings and children. Health systems with clinical genomics programs or research biobanks hold data whose exposure reaches people who never consented to anything. Tighter access to genomic results inside the record follows from that, and so does treating biobank access as a high-multiplier platform.

The answers lead to concrete controls. Proxy relationships can be reviewed on a schedule and expire at the ages set by state law and system policy. Bulk viewing can be rate-limited, so that one account cannot page through thousands of profiles in an hour. Access logs can be monitored for an account viewing far more records than its role would explain. For clinician access through exchanges, query volumes per user can be baselined and alerted on, which means learning what normal looks like for each user and flagging departures from it. These controls do not break the feature for legitimate users. A mother checking her son’s vaccination record does not need to open four hundred records in an afternoon.

Counting the multiplier

The count can usually be built from data the organization already holds. Proxy tables show who can see whom. Exchange logs show query volumes by user. Interface gateway logs show which apps pull how much and how often. The work is joining them into one table per platform: the number of accounts, the spread of how many other people each can see, and the hundred accounts with the widest reach. The top of that spread is where scarce security effort belongs.

Speed belongs in the table too. The 23andMe profiles were compiled into datasets offered for sale, which is bulk collection, not casual browsing. A portal that lets one account view a few records slowly does far less harm than one that offers an export of all of them. Export functions, reporting tools and interfaces deserve their own limits, set lower for patient-facing accounts than for staff.

The proxy lifecycle

Proxy access tends to be granted carefully and revoked carelessly. A parent gains access at birth. Access may narrow when the child reaches an age set by state law and system policy, and it should end or convert when the child becomes an adult. An adult child granted access during a parent’s illness often keeps it after recovery, after a family dispute, and sometimes after the parent’s death.

Each of those moments is an event the system can detect: a birthday, a discharge, a change in the patient’s contact details, a death recorded in the chart. Tying review to those events works better than a calendar alone. A yearly email asking patients to confirm their proxies is easy to ignore. A prompt when a teenager’s access rules change, or at the first sign-in after a hospital stay, reaches people when the question matters.

The same logic applies to staff at group homes and care agencies. Their access should end when the employment or the placement does. That only happens if the agency is required to tell the health system, so the obligation belongs in the agency’s agreement and in the proxy form itself.

Suppose a regional health system runs a patient portal with 400,000 active accounts. Most see only their own record. But a few thousand accounts belong to proxies, and a handful of those proxies manage records for many people, such as staff at a group home. The system’s median ratio is close to 1 to 1. Its maximum is far higher. A credential stuffing campaign that happens to open one of those high-multiplier accounts exposes dozens of people at once. The health system would not know this without asking the question, and the answer points precisely at where to require stronger sign-in.

The ratio is also a useful number for governance. Suppose a privacy committee sees, for each platform, the count of accounts and the median and maximum number of other people each account can see. It will ask better questions about a proposed sharing feature than a committee that sees only adoption statistics. The calculation does not need to be precise. An order of magnitude is enough to show where the largest multipliers sit.

Committees should also expect resistance on cost. Each control has a price: a vendor module, analyst time to tune alerts, call center minutes for patients who get stuck. The multiplier lets the committee spend selectively. A control that costs a great deal across 400,000 accounts may cost very little if it applies only to the few thousand that can see other people.

The consequence: which rules apply once data is out

HIPAA covers health plans, clearinghouses, most providers, and their business associates, the vendors that handle health information on their behalf. A direct-to-consumer genetics company generally sits outside it. Its data is governed by its privacy policy and by the Federal Trade Commission’s authority over unfair and deceptive practices, including the Health Breach Notification Rule.

A patchwork of state laws also applies, including genetic privacy statutes and Washington’s My Health My Data Act, enacted in 2023 and in effect for most entities from 2024. Many consumers assume their genetic results are protected like medical records. Often they are not, and reputational damage tends to arise in the gap between what people assume and what the law provides.

Health systems sit on both sides of this line. Patients bring consumer genetic results, wearable data and app data into care, and once a covered entity incorporates them into the record, HIPAA applies there. In the other direction, health systems partner with consumer health and research companies that operate outside HIPAA, and data shared with them loses HIPAA’s protections.

Data shared this way behaves like a package moving between carriers: hand it to another carrier and the coverage changes, whether or not the label on the box does. Patients see the label, which says “health system,” and rarely see the handoff.

Consent language should say plainly which rules will govern the data after it is shared. Partner contracts should require security controls that match the multiplier the partner runs. They should require breach notice to the health system as well as to individuals, and limit what happens to the data in a sale. A sale matters because a company’s data is one of its assets, and assets change hands when businesses are sold or fail. Counsel should check which state consumer health and genetic privacy laws apply to each partner.

Different regimes, different clocks

Notification duties differ by regime. A HIPAA covered entity must notify affected individuals without unreasonable delay and within 60 days of discovering a breach. It must also notify HHS and, when more than 500 residents of a state or jurisdiction are affected, prominent media outlets there. A vendor of personal health records outside HIPAA falls under the FTC’s Health Breach Notification Rule. State breach laws reach many others, with their own definitions and deadlines. A single incident at a partner can set off several timelines at once.

There is also a definitional trap. A credential stuffing incident involves no break-in to the organization’s own systems, and early statements often say so. Under HIPAA, though, an impermissible use or disclosure of protected health information is presumed to be a breach. The presumption holds unless a documented risk assessment shows a low probability that the information was compromised. A portal account opened with a stolen password and used to view records is hard to argue away.

Sales, successors and de-identified data

Business associate agreements already require a vendor to return or destroy protected health information at the end of the contract where feasible. Agreements with partners outside HIPAA rarely say as much unless someone insists. The clauses worth asking for are notice of a change of control, a right to terminate on a sale, a requirement that any buyer honor the original terms, and deletion on request.

De-identified data needs its own line. HIPAA lets de-identified data be shared without its protections, through expert determination or removal of listed identifiers. Genetic data is hard to de-identify in any lasting sense, because a genome identifies its owner and relatives’ data can help re-identify it. Contracts covering genomic or research data should forbid re-identification and limit onward sharing, whatever method was used.

Research data adds further layers. Studies of human subjects fall under the Common Rule, and many genomic studies follow NIH data sharing policy. Since 2017, NIH-funded research that collects identifiable sensitive information has received certificates of confidentiality automatically, which limit compelled disclosure. Those protections help, but they govern researchers and funders. They do not secure a participant portal against a reused password.

How the ratio plays out inside a health system

The ratio is easy enough to calculate. The difficulty is that no single person in a typical health system owns all three of its parts. The portal belongs to patient access or digital services, which is measured on adoption and satisfaction. Sign-in settings sit with the identity or security team, often configured once at launch and rarely revisited. Proxy rules are written by health information management and compliance, guided by state law on minors and guardians. Research portals sit with the research office. Partner agreements sit with legal and business development. Each group makes reasonable decisions within its own lane, and the ratio emerges from all of them together without anyone choosing it.

In practice, then, the first step is organizational rather than technical. Someone, typically the chief information security officer working with the privacy officer, should be asked to produce the ratio for every platform once a year and whenever a new sharing feature is proposed. The work is mostly a matter of asking the right people the right questions. The answers needed are how many accounts exist, what relationships let one account see another, and how many records the busiest accounts can reach.

A workable split of duties is simple. The security team owns the numerator figures: second-factor enrollment, breached-password matches and login failure trends. The privacy office owns the multiplier inventory and its annual refresh. Health information management owns proxy policy and expiry. Legal owns the consequence column for each partner. One executive, usually the chief information security officer or chief privacy officer, assembles the four into a single page.

The page doubles as evidence. The HIPAA Security Rule already requires a risk analysis and regular review of information system activity. An investigator from HHS’s Office for Civil Rights examining a portal incident would expect the risk analysis to cover the portal. The investigator would also look for written proxy policies and some record of audit log review. A ratio table, kept current, shows that the organization looked at exposure from the patient’s side and acted on what it found.

The second step is to put the number where decisions are made. When the digital team proposes letting family members invite one another into a shared view, the proposal should arrive with an estimate of how the maximum multiplier would change. When a research program proposes a participant portal that shows cohort information, the same estimate applies. When a vendor offers a feature that connects outside apps, the question is how much one authorization can pull, and how quickly.

The third step is to tie authentication strength to the multiplier. Accounts that can see only their own record can be held to a lighter standard. Accounts that can see many people should be held to a stronger one. Most organizations already treat their employees’ access this way. The 23andMe episode shows why the same logic belongs on platforms used by patients and families.

Two cautions apply. A higher bar for some patient accounts can look like unequal treatment, and it will fall hardest on caregivers who manage records for many people. Those caregivers are often the patients’ most important helpers. The burden should come with support: a dedicated help line, longer sessions on recognized devices, and a recovery path that does not depend on a single phone.

The second caution concerns information blocking. The rules include exceptions for security and privacy practices, but those exceptions have conditions. A control that delays or denies access must be tailored to a real risk and applied consistently. Stronger sign-in for high-multiplier accounts fits that logic. Blanket friction designed to discourage use does not, and counsel should review any control that refuses access instead of verifying identity.

Finally, the ratio gives the board a simple way into a technical subject. A director does not need to understand bot detection to ask why one account on the portal can see two hundred patients, and whether that account is protected accordingly.

Sign-in as a dial, not a switch

A health system that has absorbed this episode can answer three questions quickly for every patient-facing platform. It knows how hard it is to take over an account, how many people one account can see, and what rules protect the data if it leaves. It reports the second number alongside portal adoption, so that growth in sharing features is visible as growth in exposure as well as in convenience.

It also treats authentication as a dial rather than a switch. Low-risk actions, such as viewing an appointment time, can stay easy. High-risk actions, such as adding a proxy, changing contact details or downloading a full record, ask for more. That approach protects patients without punishing them, and it keeps the portal adoption numbers that leadership cares about.

Signals that move the dial

A dial needs inputs. Common signals include a new device, sign-in from an unusual location, a burst of failed attempts before a success, and an account suddenly reaching many records. Actions that should move the dial include adding a proxy, changing contact details, downloading a full record and authorizing a new app. Most identity platforms can combine such signals into a risk score and demand an extra step only when the score is high.

Risk scoring has drawbacks. Patients on shared family devices, on mobile networks that change address often or behind a privacy tool can trip the signals more than others. Scores are opaque, and a patient challenged for no visible reason may call or give up. Health systems should track challenge rates and abandonment by patient group, and adjust when one group bears most of the friction. A dial that nobody calibrates turns into a switch again.

The usual failures are predictable. The first is leaving security settings at the vendor’s defaults, which are usually tuned for ease of sign-up. The second is treating proxy access as permanent: relationships created when a child was born, or when a parent was ill, persist for years. The third is measuring success only by adoption, which rewards every new sharing feature and never prices the exposure. The fourth is assuming HIPAA protects data that has left the building, and writing partner contracts and consent forms accordingly. The fifth is keeping login failure data in a support queue where nobody in security sees it.

A sixth failure is subtler. Many organizations measure the numerator carefully and ignore the multiplier. They report second-factor enrollment proudly and never ask which accounts can see the most. 23andMe’s exposure came from the combination: an ordinary takeover rate multiplied by a feature that reached hundreds of people per account. Measuring one term without the other tells a health system little about its own exposure.

There is nothing exotic in that list. Each failure is the default outcome when no one has been asked to own the ratio.

Before the next sharing feature ships

• For each patient-facing platform, how many other people’s records can one account see, at the median and at the maximum?
• Is multi-factor authentication required for proxies, and for changes to phone numbers and email addresses?
• Who decided our current authentication settings, and was it a leadership decision or a vendor default?
• Can one account page through hundreds of records in an hour, and would anyone notice if it did?
• For every partner outside HIPAA, what rules govern the data we share, and do our contracts require breach notice and limit what happens to the data if the partner is sold?

The answers do not need to be perfect to be useful. A rough ratio, an honest note about who chose the settings and a list of partners outside HIPAA would put most health systems ahead of where 23andMe’s customers found themselves in October 2023.

Sequencing matters as much as the list. The cheapest steps come first: breached-password screening, alerts on login failure spikes and a count of the widest-reaching accounts. Stronger sign-in for proxies and contact changes follows, once the support team is ready for the calls. Contract and consent changes take longest, because they wait for renewals and legal review. Starting all three tracks in the same quarter means early results arrive while the slow work is still under way.

With hindsight

The breach reshaped the company. 23andMe faced class actions and regulatory investigations in several countries and agreed in 2024 to settle the main U.S. class litigation. By March 2025, according to its SEC filings, its settlements of U.S. customer claims, including claims brought in arbitration, came to $37.5 million in all.

Its business deteriorated in parallel. On March 23, 2025, the company filed for Chapter 11 in the federal bankruptcy court for the Eastern District of Missouri. Chapter 11 is the form of bankruptcy in which a company reorganizes or sells its assets under court supervision. Its co-founder, Anne Wojcicki, stepped down as chief executive that weekend and stayed on the board.

The bankruptcy raised a question many customers had never considered: what happens to genetic data when the company holding it fails. State attorneys general, starting with California’s two days before the filing, urged customers to consider deleting their genetic data. California’s alert reminded residents that state genetic privacy law and the California Consumer Privacy Act let them delete their accounts and data, have their saliva samples destroyed and withdraw consent for research use.

The assets were sold through a court-supervised process under Section 363 of the Bankruptcy Code. On July 14, 2025, TTAM Research Institute, a nonprofit founded and led by the co-founder, completed the acquisition. The buyer said it was committed to giving customers choice and transparency over their data, including the option to change their decision about research participation.

Regulators abroad also weighed in. In June 2025 the United Kingdom’s Information Commissioner’s Office fined the company £2.31 million for failing to protect users’ data, after the joint investigation with Canada’s privacy commissioner. The regulator counted 155,592 UK residents whose information had been accessed. It cited the absence of mandatory multi-factor authentication, weak password practices and predictable usernames. That finding speaks directly to the numerator of the ratio: how easy it was to get in.

Two other findings deserve a health system’s attention. The first concerns detection. The regulator described credential stuffing running from April to September 2023, while the company handled the warning signs as isolated matters, before a full investigation began. A spike in failed logins routed to security, as the body of this article recommends, is the kind of signal that shortens that window. The second concerns export. The regulator found no extra verification before raw genetic data could be downloaded, which is the bulk-download problem in another form.

U.S. health regulators moved in a similar direction for the organizations HIPAA covers. In January 2025 the Department of Health and Human Services proposed a broad update to the HIPAA Security Rule. Among many other changes, it would make multi-factor authentication a required control, with limited exceptions, instead of a choice left to each entity’s risk analysis. Health systems should ask counsel how any final version applies to patient-facing systems as well as workforce access.

At home, consumer health data laws continued to spread among states, narrowing the gap between what people assume about health privacy and what the law provides, though not closing it. The FTC also updated its Health Breach Notification Rule in 2024 to make clearer that it reaches health apps and similar technologies outside HIPAA.

The multiplier problem did not go away. Proxy access, connected apps and cross-organization views all grew after 2023, and with them the number of people one compromised credential can expose. Every one of those features exists for good reasons, which is why the exposure tends to grow without anyone deciding that it should.

A breach’s size is set long before the attacker arrives. It is set when a sharing feature is designed, when sign-in settings are chosen, and when a contract decides where data can go. A company that started with roughly 14,000 compromised accounts ended up in bankruptcy court, with its data’s future debated by state attorneys general. The difference between those two outcomes was the multiplier.

Health systems are unlikely to face the same commercial collapse. They do face the same arithmetic, and they have the advantage of being able to measure it before someone else does.