Spain

23ANDME, INC

2,400,000 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2026-07-16.

Rank · Sector

of 293 in Health Care

Rank · Spain

#19

of 1,133

Rank · All fines

#128

of 3,267

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2026-07-16
Controller / Processor: 23ANDME, INC
Sector: Health Care
Quoted Articles: Art. 5 (1) f) GDPR, Art. 33 GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Spanish DPA has imposed a fine of EUR 2,400,000 on 23ANDME, INC. A cyberattack involving user credentials from previous data breaches resulted in unauthorised access to the accounts of 2,642 individuals. The controller offers genetic testing to customers and the leaked data included genetic data relating to ethnic origin, as well as identity and location data. This personal data was offered for sale on the dark web. On 1 October 2023, the controller became aware of the breach. After confirming the authenticity of the data, the controller first notified the US authorities. It was subsequently found that Spanish data subjects were also affected. The controller informed the AEPD about the breach on 17 October 2023. The authority found that the notification exceeded the legal deadline, particularly given the sensitivity of the data involved.

Open original source Links to the regulator's original publication or another source.