23andMe has disclosed that a data scraping incident has taken place, resulting in hackers gaining access to sensitive user information and selling the data in a common hacking forum. 23andMe is a personal genomics and biotechnology giant that offers DNA testing services and is based in the United States. Samples of data were allegedly stolen from 23andMe and later leaked by a threat actor beginning on October 2, 2023. On October 4, 2023, the threat actor began offering data profiles in bulk, ranging from $1 to $10 per account depending on the number of accounts purchased. The exposed data is associated to customers of Chinese and Ashkenazi heritage specifically. The exposed data includes full name, usernames, profile photos, sex, date of birth, genetic ancestry results, health information, origin estimation, and more. It should be noted that the threat actor “accessed a small number of 23andMe accounts and then scraped the data of their DNA Relative matches,” which is a feature an account would need to opt-in to. A spokesperson for 23andMe has confirmed that the leaked data is legitimate and attributed this leak to a credential-stuffing attack, where threat actors use previously stolen credentials from an organization to access additional accounts at other organizations through recycled passwords. The spokesperson also stated that the organization does not have any indication that a data security incident has taken place within their systems and did not specify the number of customer accounts impacted.