UK and Canada joint investigation into 23andMe data theft

TechCrunch reports that the Office of the Privacy Commissioner of Canada and the Office of the Information Commissioner of the United Kingdom have conducted a joint investigation into the massive data breach at 23andMe last year, which resulted in the exposure of confidential information of 6.9 million users.

In addition to examining the extent of the data release and the potential harm to the individuals affected, both the OPC and the ICO will also examine the US genetic testing provider’s implementation of data protection safeguards and the timely reporting of data breaches to regulators.

“This data breach has had international implications and we look forward to working with our Canadian colleagues to ensure that people’s personal data in the UK is protected,” said ICO Commissioner John Edwards.

23andMe has now committed to collaborating on the joint study.

“We intend to comply with the reasonable requests of these regulators related to the credential stuffing attack discovered in October 2023,” said 23andMe spokesman Andy Kill.