The 23andMe cyber saga continues at a global scale…

Three years on and the ramifications of the major cyber incident that affected genetic research company 23andMe in 2023 are still being felt, with the incident resulting in multi-jurisdictional regulatory fines and litigation. We compare the recent fine from the Spanish data protection authority (the AEPD) to the ICO’s 2025 fine in respect of the same incident, highlighting some key learnings about the differing regulatory approaches and the implications for handling global incidents. 

Regulatory approach: ICO v AEPD 

The UK and Spanish data regulators found similar underlying GDPR security failings (for example, credential stuffing attacks exploiting gaps in multi-factor authentication (MFA) and username/password-only authentication), and fined similar amounts (£2,31m in the UK and €2,4m in Spain, even though significantly more individuals were impacted in the UK). However, there were some differences in their approach: 

• Notification delay: Both regulators reported that 23andMe failed to notify them of the breach within the 72-hour statutory period. However, the AEPD chose to split its fine in two - €2 million for data security failings and €400,000 for notification delays. The AEPD found the company’s reason for the delay, in choosing to identify affected individuals first and only then considering notification obligations, to be unsatisfactory and indicative of a “lack of diligence”. The ICO took a different approach, accepting 23andMe’s justifications for the delay as satisfactory - accordingly it found no separate infringement for notification delays. It did not consider the delay an aggravating factor either. 
   
• Financial hardship: The ICO reduced its fine (from £4.49m initially) to reflect 23andMe’s severely deteriorated financial position, using the 2025 financial year's global projected (lower) turnover following bankruptcy filings in the US. Conversely, the AEPD resolution notes 23andMe's US bankruptcy filing only as a procedural background fact and used 23andMe’s pre-bankruptcy turnover as a starting point. 
   
• Scale of investigation and evidentiary depth: The ICO notice is much more granular - running to a detailed forensic chronology spanning roughly 150 numbered paragraphs of factual findings. The AEPD's resolution is comparatively short and relies principally on 23andMe's own breach notifications and a single request for information. It is unclear whether this is linked to the ICO being the first to fine and the AEPD potentially (and unofficially) relying on the ICO’s work. 
   
• Relevance of publicly available reports: The AEPD relied on an annual financial report on the company’s website which disclosed their pre-breach awareness of GDPR obligations and cyber risk to support its findings in relation to both infringements. Although the same report was likely available to the ICO, it did not refer to it, focussing instead on the fact that 23andMe had dismissed more specific early warning signs of a potential incident. 

Key practical learnings from the fines

So what lessons can organisations take from these two fines and their slightly differing approaches?

• Where global fines are a risk, be strategic in your notifications. Regulators differ in how they calculate fines and some penalise delays to notification more than others. For example, the Polish and Spanish regulators are among a few EU regulators that have issued fines solely for notification delays, whereas others (such as the ICO) tend to focus on delays as part of more substantive failings (. Organisations should therefore work closely with their legal team or advisers ahead of any incident to understand which jurisdictions to prioritise when it comes to notifications (and whether the EU’s one-stop shop applies). 
   
• Special category data raises the bar. It was obvious in the 23andMe fines that special category data was involved, but organisations should review their data mapping to identify any inferred special category data as well. 
   
• Annual reports are relevant. The AEPD used 23andMe’s own public filings to evidence pre-breach awareness of cyber risk, as mentioned above. The message here is clear: public risk reporting needs to be matched by substantive data security measures (and prompt and well documented remediation). This is particularly so given increased obligations on listed companies (see our blog) and scope for securities-based claims. 
   
• This is your final warning… Regulators expect organisations to learn from past enforcement. The ICO, for example, clearly sets out in its monetary penalty notices where the minimum security measures it expects have not been met (e.g. failing to implement MFA or other non-compliance with published security standards) and the AEPD’s comments around timely notifications show the procedural expectations in Spain.

The bigger picture

Where incidents affect multiple jurisdictions, controllers may face not only joint investigations and enforcement actions (such as the joint UK and Canadian action regarding 23andMe) but also separate regulatory proceedings running in parallel, sometimes over different time periods (as was the case here). Organisations should therefore monitor enforcement actions taken in other jurisdictions and ensure consistency in the information provided, not least because authorities are likely to take note of, and potentially building on, each other’s work.

Regulatory enforcement may also be only part of the picture. Following the 2023 attack, 42 US states launched a multi-state investigation into the company's security practices. After 23andMe filed for bankruptcy in March 2025, participating states brought claims that resulted in damages capped at $18 million. Separately, 23andMe agreed a $46.75 million class action settlement for affected US customers. The case is therefore a reminder that incidents can create regulatory, litigation and wider financial exposure long after the initial breach.

Finally, the overall message is clear and twofold: firstly, cyber remains high on the regulatory agenda - something we’ve seen reaffirmed recently in the ICO’s priorities for 2026-8 (see our blog).  Secondly, organisations operating across jurisdictions will need a global incident response strategy that reflects differing regulatory approaches, enforcement priorities and litigation risk.