How do I find out if my data was included in the 23andMe breach?

Send a GDPR subject access request to 23andMe. Under Article 15 GDPR, they must confirm whether they process your personal data and provide a copy. This is free and they must respond within one month.

Can I request 23andMe delete my data after the breach?

Yes. Under Article 17 GDPR (the right to erasure), you can request that 23andMe delete all personal data they hold about you. The data breach may provide additional grounds for this request.

How long does 23andMe have to respond to my GDPR request?

One month from the date they receive your request. They can extend this by two further months for complex requests, but must inform you within the first month.

← All breach guides

23andMe data breach — exercise your GDPR rights

Q: What data was exposed in the 23andMe breach?

2023 (6.9 million users): Attackers used credentials from earlier, unrelated breaches to access approximately 14,000 23andMe accounts via credential stuffing. By exploiting the 'DNA Relatives' feature, they harvested the profile data of a further 6.9 million connected users. The stolen data included predicted ethnicity, health predispositions, and relative match information. The breach disproportionately targeted Ashkenazi Jewish and ethnically Chinese users.

What happened

2023 6.9 million users affected

Attackers used credentials from earlier, unrelated breaches to access approximately 14,000 23andMe accounts via credential stuffing. By exploiting the 'DNA Relatives' feature, they harvested the profile data of a further 6.9 million connected users. The stolen data included predicted ethnicity, health predispositions, and relative match information. The breach disproportionately targeted Ashkenazi Jewish and ethnically Chinese users.

Data exposed:

Genetic ancestry composition (predicted ethnicity)
Health predisposition reports
Wellness and trait reports
DNA relative matches and family tree data
Full names
Dates of birth
Sex at birth
Profile photos
Locations

What you can do

Genetic data is the most sensitive personal information under GDPR — it is immutable, uniquely identifies you, and reveals information about your relatives without their consent. With 23andMe having filed for bankruptcy and been acquired in 2025, exercising your right to erasure now is especially important to prevent your genetic data being used for purposes you never consented to.

You have two key rights under GDPR:

Article 15 — Right of Access: Request a full copy of all data 23andMe holds about you. This is the best first step.
Article 17 — Right to Erasure: Request that 23andMe delete all your personal data. Use the erasure template for this.

Note: 23andMe was acquired by TTAM Research Institute in June 2025 following bankruptcy. GDPR obligations transfer with the data. Submit requests via 23andMe's privacy portal; if unresolved, escalate to your national data protection authority. Privacy portal ↗

Generate your access request

This letter is pre-addressed to 23andMe, Inc., the official EU data controller for 23andMe.

To: 23andMe, Inc.
349 Oyster Point Blvd, South San Francisco, CA 94080, USA

Dear Data Protection Officer,

I am writing to exercise my rights under the General Data Protection Regulation (GDPR). As an individual whose personal data you process, I am requesting the following information:

Confirmation that you are processing my personal data.
A copy of my personal data.
The purposes of the processing.
The categories of personal data concerned.
The recipients or categories of recipients to whom my personal data has been or will be disclosed.
The envisaged period for which my personal data will be stored, or the criteria used to determine that period.
The existence of my right to request rectification or erasure of my personal data, or restriction of processing, or to object to such processing.
Information about the source of my personal data if it was not collected directly from me.
The existence of automated decision-making, including profiling, and meaningful information about the logic involved.

Below is my information for your reference:

Name:
Email:
Address:

This request is of utmost importance to me and should not be ignored. The GDPR mandates that you respond within one month. Failure to comply may result in further action being taken.

Thank you for your prompt attention to this matter.

Sincerely,

Text copied to clipboard

1. Copy and send this letter to the data controller of the organisation.

2. Follow up until you hear back. The GDPR requires a response within one month.

3. No response? Lodge a complaint with your local data protection authority.

No response after one month? File a complaint with your DPA →

Select your country to find your data protection authority: