Was Your 23andMe Data Leaked? How to Delete It

Last updated: October 24, 2026. Based on 23andMe's December 2023 blog post, TechCrunch reporting from December 2023 and January 2024, U.S. Bankruptcy Court documents from June 2025, and California Attorney General consumer alert from March 2025.

In 2023, you used a strong password on 23andMe. You never clicked a phishing link. Your account was safe. But your DNA data wasn't.

Hackers logged into about 14,000 23andMe accounts using passwords leaked from other sites. Then they opened DNA Relatives, the feature that matches you with family. That's how 14,000 accounts became 6.9 million profiles. Names, birth years, locations, ancestry reports. Most of those people were never hacked. Their relatives were.

In 2025, the company filed for bankruptcy, and a court approved selling its customer data. About 1.9 million people deleted their accounts. If you tested with 23andMe, here's what happened and how to delete your data now.

#Watch: Was your 23andMe data leaked?

This video explains the 2023 breach, how DNA Relatives exposed millions, and the deletion steps.

#What happened with 23andMe in 2023

#14,000 accounts accessed via credential stuffing

Per 23andMe's blog post "Addressing Data Security Concerns – Action Plan" (updated December 2023):

"a threat actor accessed a select number of individual 23andMe.com accounts through a process called credential stuffing. That is, usernames and passwords that were used on 23andMe.com were the same as those used on other websites that have been previously compromised"

The blog post states:

"The threat actor was able to access less than 0.1%, or roughly 14,000 user accounts."

Credential stuffing means hackers took passwords leaked from other breached websites and tried them on 23andMe. If you reused a password from a site like LinkedIn, Dropbox, or Adobe (all breached in past years), and that same password was your 23andMe password, hackers could log in as you.

#DNA Relatives exposed 6.9 million profiles

TechCrunch reported on December 4, 2023, in "23andMe confirms hackers stole ancestry data on 6.9 million users":

"hackers accessed the personal information of about 5.5 million people who opted-in to 23andMe's DNA Relatives feature, which allows customers to automatically share some of their data with others. The stolen data included the person's name, birth year, relationship labels, the percentage of DNA shared with relatives, ancestry reports and self-reported location."

TechCrunch added:

"another group of about 1.4 million people ... had their Family Tree profile information accessed"

That's 6.9 million profiles total.

TechCrunch also reported:

"by hacking into one individual account, the hackers were able to see the personal data of both the account holder as well as their relatives."

So if your cousin's account was hacked and you used DNA Relatives, the hacker saw your profile too.

#Most victims were never hacked

TechCrunch reported on January 3, 2024, in "23andMe tells victims it's their fault that their data was breached":

"by hacking into only 14,000 customers' accounts, the hackers subsequently scraped personal data of another 6.9 million customers whose accounts were not directly hacked."

If your password was strong and unique, but your relative's password was reused and weak, the breach still exposed your profile data through DNA Relatives.

#What happened in 2025: bankruptcy and data sale

#23andMe filed for bankruptcy

23andMe filed for Chapter 11 bankruptcy on March 23, 2025, per the SEC Asset Purchase Agreement and court records.

#The court approved selling customer data

Per the U.S. Bankruptcy Court for the Eastern District of Missouri's Memorandum Opinion dated June 27, 2025 (Case 25-40976):

"The transaction as currently structured involves the transfer of the Debtors' assets, including genetic and other personally identifiable information (PII), from the Debtors to a newly formed subsidiary, which will then be sold to TTAM in an equity transaction."

The court wrote:

"For the reasons discussed below, I will grant the Debtors' sale motion and approve the..."

The sale closed July 14, 2025. Per TTAM's July 14, 2025 press release:

"As part of TTAM, 23andMe is continuing to operate"

#1.9 million people deleted their accounts

The U.S. Bankruptcy Court's June 27, 2025 opinion states:

"approximately 1.9 million customers have deleted their accounts since the Debtors commenced these Chapter 11 cases"

#How to delete your 23andMe data

If you tested with 23andMe and want to delete your data, you can do it now. Deletion is permanent and cannot be canceled or reversed.

#Step-by-step: delete your 23andMe account

Per the California Attorney General's consumer alert from March 21, 2025 and 23andMe Support article "What's In Your Account Settings?" (live as of October 24, 2026):

1. Log into your 23andMe account on the website (not the app).

2. Go to Settings. Click on your profile name in the upper right-hand corner and select "Settings."

3. Scroll to the bottom and find the section labeled "23andMe Data."

4. Click "View" next to "23andMe Data."

5. (Optional) Download your data. If you want a copy before deleting, download it here. The California AG's alert says: "Download your data."

6. Scroll to the "Delete Data" section.

7. Click "Permanently Delete Data."

8. Confirm the request. You'll receive an email from 23andMe asking you to confirm. Follow the link in the email.

Per 23andMe Support:

"you will receive an email ... requesting that you confirm your request ... it cannot be canceled, undone, withdrawn, or reversed."

#What deletion covers

Per 23andMe Support, deleting your account and personal information means 23andMe will delete your profile, genetic data, and related information. Note that 23andMe Support also states that some data may be retained to comply with legal obligations.

#What deletion doesn't fix

• Data already stolen in 2023. If your profile was exposed through DNA Relatives during the breach, deletion now doesn't erase data hackers already downloaded.

• Data already sold. If your data was included in the bankruptcy asset sale in 2025, deletion may not cover data already transferred to the acquiring company. The court opinion and 23andMe's policies don't specify how post-sale deletion requests are handled.

• Biological relatives. Deleting your account removes your profile from DNA Relatives, but your genetic relatives may still have their accounts and their matches.

#Why the 23andMe breach was different

The 23andMe breach was different from typical security breaches. Rather than hackers breaking into 23andMe's systems, they used credential stuffing with passwords leaked from other sites. The problem was network effects: DNA Relatives made your data visible to people you were connected to, so when one person's account was compromised through password reuse, millions of connected profiles were exposed.

#You can do everything right and still be exposed

If you:

• Used a unique, strong password on 23andMe
• Enabled two-factor authentication
• Never clicked a phishing link

You could still be in the breach if a relative used a weak password and you opted into DNA Relatives.

This is why privacy advocates warn about data you can't control. Once you share genetic data with a service, and that service shares it with your relatives through a feature like DNA Relatives, your privacy depends on everyone else's security practices, not just your own.

#Should I delete my 23andMe account?

That depends on what you value more: keeping access to your genetic data and future updates, or removing your data from a company that was breached and went through bankruptcy.

#Reasons to delete:

• The 2023 breach. If your data was exposed through DNA Relatives, deletion prevents future exposure (but doesn't erase stolen data).

• The 2025 bankruptcy sale. If you don't want your genetic data held by a company that went through bankruptcy and sold its assets, deletion is the only way out.

• You don't use it anymore. If you downloaded your reports and don't need 23andMe's ongoing features, there's no reason to keep the account.

#Reasons not to delete:

• You use the health or ancestry features. If you rely on 23andMe's health reports or DNA Relatives for finding family, deletion means losing that access.

• You want future research updates. 23andMe occasionally updates reports with new research. Deletion ends those updates.

• Your data may already be out there. If your data was stolen in 2023 or included in the asset sale, deletion doesn't erase those copies.

#What the law says (as of October 2026)

#California residents have rights under the CCPA

If you live in California, you can request that 23andMe:

1. Disclose what personal information 23andMe collected about you.

2. Delete your personal information (which 23andMe must do unless an exemption applies).

3. Stop selling or sharing your personal information for cross-context behavioral advertising.

The California Attorney General's March 21, 2025 consumer alert specifically addressed 23andMe customers and urged them to consider deleting their accounts.

#Other states with privacy laws

Virginia, Colorado, Connecticut, Utah, and several other states passed privacy laws between 2021 and 2026. If you live in one of those states, check whether your state's law gives you the right to request deletion of your data from 23andMe.

#Genetic privacy laws

Some states have genetic privacy laws that give you additional protections. For example, California's Genetic Information Privacy Act (GIPA) restricts how companies can use and share genetic data.

#Other DNA testing companies

23andMe is not the only DNA testing company. AncestryDNA, MyHeritage, FamilyTreeDNA, and others have similar features that let you connect with genetic relatives. Those features have the same network effect risk: if one person's account is compromised, connected profiles can be exposed.

If you use another DNA testing service:

• Check its privacy policy to see what data is shared through relative-matching features.

• Check its data retention policy to see how long it keeps your genetic data after you delete your account.

• Use a unique, strong password on every DNA testing site, and enable two-factor authentication if available.

• Consider opting out of relative-matching features if you don't need them.

#Conclusion

The 23andMe breach shows how network effects can expose your data even when your own security is perfect. DNA Relatives connected millions of people, and when hackers accessed 14,000 accounts through password reuse, they scraped profile data for 6.9 million.

If you tested with 23andMe and want to delete your data, log into the website, go to Settings, scroll to 23andMe Data, click View, then Permanently Delete Data. Confirm the email. Deletion cannot be undone.

The 2025 bankruptcy and asset sale add another reason to consider deletion. About 1.9 million customers already deleted their accounts. If you don't need 23andMe's features anymore, deletion is the only way to remove your data from the service.

UndoLeak erases your data from data brokers and keeps it off. DNA testing is one way your genetic and family data spreads. We handle people-search sites, public records, and leaked profiles so your personal information stays private.

#Sources

1. 23andMe, "Addressing Data Security Concerns – Action Plan" (updated December 2023). https://www.23andme.org/blog/articles/addressing-data-security-concerns/

2. Lorenzo Franceschi-Bicchierai and Zack Whittaker, "23andMe confirms hackers stole ancestry data on 6.9 million users," TechCrunch (December 4, 2023). https://techcrunch.com/2023/12/04/23andme-confirms-hackers-stole-ancestry-data-on-6-9-million-users/

3. TechCrunch, "23andMe tells victims it's their fault that their data was breached" (January 3, 2024). https://techcrunch.com/2024/01/03/23andme-tells-victims-its-their-fault-that-their-data-was-breached/

4. U.S. Bankruptcy Court, E.D. Missouri, In re 23andMe Holding Co., Case 25-40976, Memorandum Opinion (June 27, 2025). https://www.moeb.uscourts.gov/sites/moeb/files/opinions/25-40976%5FBK%5F01%5F23andMe.pdf

5. California Attorney General, "Attorney General Bonta Urgently Issues Consumer Alert for 23andMe Customers" (March 21, 2025). https://oag.ca.gov/news/press-releases/attorney-general-bonta-urgently-issues-consumer-alert-23andme-customers

6. 23andMe Support, "What's In Your Account Settings?" (accessed October 24, 2026). https://customercare.23andme.com/hc/en-us/articles/360004944654-What-s-In-Your-Account-Settings

7. TTAM, "TTAM Research Institute, A Nonprofit Public Benefit Corporation, Acquires Assets of 23andMe" (July 14, 2025). https://www.23andme.org/media-center/press-releases/ttam-research-institute-nonprofit-public-benefit-corporation/

All profile data shown in the video is fictional and recreated for illustration. The video shows simplified recreations, not actual screenshots. This is general information, not legal advice.