Example: How Reused Passwords Exposed 6.9 Million 23andMe Customers

A huge hall lined from floor to ceiling with hundreds of small identical metal mailboxes/lockers, and dozens of their little doors swinging open.

In late 2023, genetic testing company 23andMe confirmed that criminals had accessed 6.9 million customer accounts^[1]. The company was not hacked directly. The attackers used passwords stolen from entirely different websites^[1] and simply tried them on 23andMe accounts. They worked, because millions of customers had reused the same passwords across multiple sites.

Personal information, including names, birth years, and ancestry data, was taken from every one of those 6.9 million accounts. 23andMe faced lawsuits and paid a $30 million settlement.