The U.K.’s information commissioner has issued a £2.31 million fine to direct-to-consumer genetic testing company 23andMe. The revelation came Tuesday after a joint investigation with Canada’s privacy commissioner revealed a “profoundly damaging” global data breach nearly two years ago was the result of the company “failing to implement appropriate security measures to protect the personal information of users.”