23andMe lacked strong data protection allowing for breach: Canada’s privacy head

In a joint investigation with U.K. Information Commissioner John Edwards, Canadian Privacy Commissioner Philippe Dufresne has determined that 23andMe — the direct-to-consumer genetic testing company that was targeted in a global data breach nearly two years ago — lacked strong enough data protection that it “enabled a hacker to carry out a credential stuffing attack.”

• 23AndMe had ‘inadequate’ security before ‘profoundly damaging’ hack: probe