Fourteen thousand accounts, 6.9 million people: the 23andMe ratio every health data platform should measure

The week

On October 6, 2023, the consumer genetic testing company 23andMe confirmed that user profile information had been compiled from its platform and offered for sale online. The company said attackers had signed in to customer accounts with passwords reused from other breaches, a technique known as credential stuffing. They then used the opt-in DNA Relatives feature to view what matched relatives had chosen to share, such as names, birth years, relationship labels, ancestry reports and in some cases location. Early listings were reported to single out users of particular ancestries. In a December filing with the SEC, 23andMe said about 14,000 accounts, roughly 0.1 percent of users, had been accessed directly. It said data on about 6.9 million people had been reached through its relative-matching features. By then it required two-step verification for all users.

23andMe’s consumer service is not a HIPAA covered entity, and few health systems would call it a peer. The incident still carries a measurement that health systems can apply to their own platforms: the ratio between accounts an attacker controls and people whose data those accounts can see. At 23andMe the ratio was roughly 1 to 500. A patient portal with proxy access, a research participant portal, or a care coordination app shared across organizations each has its own ratio, and few organizations have calculated it. We look at the ratio in three parts, which correspond to its three terms: the numerator, meaning how easily an attacker takes over accounts; the multiplier, meaning what each account can see about other people; and the consequence, meaning which rules protect the data once it is out.

The numerator: account takeover

Credential stuffing requires no skill. Attackers take username and password pairs leaked elsewhere and try them at scale, relying on reuse. Defenses are well known: multi-factor authentication, screening passwords against known breached lists, detection of automated login attempts, and rate limiting by device and network. In 2023 many consumer health services left multi-factor authentication optional because each added step lowered sign-ups and engagement.

Patient portals face the same pressure. Health systems want patients to message clinicians, view results and pay bills online, and portal use is often a tracked performance goal. That makes authentication a trade-off that belongs with leadership, not with the portal vendor’s default settings. A reasonable baseline starts with breached-password screening for everyone and bot detection at the login page. Multi-factor authentication can be offered to all patients and required for proxies and sensitive actions. Changing a phone number or email address, the usual first move after a takeover, should trigger step-up verification. The patient access team should report login failure spikes to security the same way the security team reports alerts.

The multiplier: what one account can see

23andMe’s feature worked as designed. Each customer chose to share with matches, and each compromised account could therefore read many relatives’ shared profiles. The security of one person’s data depended on the password habits of hundreds of strangers.

Health systems build multipliers on purpose, because they serve patients well. Proxy access lets a parent, adult child or caregiver see another person’s record. Some research portals show participants information about cohorts or matched studies. Clinician-facing views in health information exchanges let one credential search across many organizations’ patients. Third-party apps connected through interoperability rules can pull a full record with one authorization.

Each deserves the 23andMe question in writing: if this one account were controlled by an attacker, how many other people’s records could it see, and how fast could it read them? The answers lead to concrete controls. Proxy relationships can be reviewed on a schedule and expire at the ages set by state law and system policy. Bulk viewing can be rate-limited, so that one account cannot page through thousands of profiles in an hour. Access logs can be monitored for an account viewing far more records than its role would explain. For clinician access through exchanges, query volumes per user can be baselined and alerted on. None of these break the feature for legitimate users.

The ratio is also a useful number for governance. Suppose a privacy committee sees, for each platform, the count of accounts and the median and maximum number of other people each account can see. It will ask better questions about a proposed sharing feature than a committee that sees only adoption statistics. The calculation does not need to be precise. An order of magnitude is enough to show where the largest multipliers sit.

The consequence: which rules apply

HIPAA covers health plans, clearinghouses, most providers, and their business associates. A direct-to-consumer genetics company generally sits outside it. Its data is governed by its privacy policy and by the Federal Trade Commission’s authority over unfair and deceptive practices, including the Health Breach Notification Rule. A patchwork of state laws also applies, including genetic privacy statutes and Washington’s My Health My Data Act, enacted in 2023 and in effect for most entities from 2024. Many consumers assume their genetic results are protected like medical records.

Health systems sit on both sides of this line. Patients bring consumer genetic results, wearable data and app data into care, and once a covered entity incorporates them into the record, HIPAA applies there. In the other direction, health systems partner with consumer health and research companies that operate outside HIPAA, and data shared with them loses HIPAA’s protections. Consent language should say plainly which rules will govern the data after it is shared. Partner contracts should require security controls that match the multiplier the partner runs, breach notice to the health system as well as to individuals, and limits on what happens to the data in a sale. Counsel should check which state consumer health and genetic privacy laws apply to each partner.

With hindsight

The breach reshaped the company. 23andMe faced class actions and regulatory investigations in several countries and agreed in 2024 to settle the main U.S. class litigation. Its business deteriorated, and in March 2025 it filed for Chapter 11, which led state attorneys general to urge customers to consider deleting their genetic data; a later article in this series covers what the bankruptcy did to its privacy promises. Its assets were acquired that year by a nonprofit research institute led by its co-founder. In June 2025 the United Kingdom’s Information Commissioner’s Office fined the company for failing to protect users’ data, citing among other things weak authentication. Consumer health data laws continued to spread among states. The multiplier problem did not go away: proxy access, connected apps and cross-organization views all grew after 2023, and with them the number of people one compromised credential can expose.