“DNA testing giant 23andMe has agreed to pay $30 million to settle a lawsuit over a data breach that exposed the personal information of 6.4 million customers in 2023.”
That is under $5 per exposed customer. Attackers stuffed reused passwords for five months and walked off with health reports and raw genotype data. The settlement now requires mandatory two-factor authentication, the control that would have stopped it. 23andMe still “denies any wrongdoing whatsoever.”