When One Credential Opens the Door to Millions of Profiles
In October 2023, 23andMe disclosed an incident involving unauthorized access to customer profiles. According to reports, the criminals allegedly used credential stuffing, a technique that tests combinations of credentials previously exposed in other environments against a service. The case brought to light a risk that many companies underestimate: one user's compromised password can become the gateway to information far beyond that single account.
According to TechCrunch, about 14 thousand accounts, equivalent to 0.1% of the user base reported by the company, were accessed directly. Through those accounts, attackers accessed profile information for approximately 6.9 million users who participated in the DNA Relatives feature. The data described in the report included name, year of birth, relationship labels, self-reported location and ancestry information.
The public impact also extended into the legal sphere. In September 2024, it was reported that the company agreed to a US$ 30 million settlement related to lawsuits over the incident, still subject to court approval at the time the report was published. The same source stated that the settlement called for strengthened security protocols, including two-factor authentication and protections against credential stuffing.
There is not enough public information to determine which internal controls were present, absent or specifically failed at the organization. The relevant lesson for decision-makers lies in the dynamics of the risk: when systems connect profiles, permissions, shared data or partners, a single compromised identity can produce disproportionate consequences.
Context: Vectors That Amplify Incidents
Although the internal details of the incident are not public, attacks like this one generally exploit vectors such as compromised or weak credentials, lack of multi-factor authentication and overreliance on passwords as the only barrier. Credential stuffing occurs when attackers automate attempts using email and password pairs already exposed in other breaches. If a person reuses the same password in the corporate environment, a legitimate account can be used to access portals, files, customer service systems or cloud resources.
The second relevant vector is the lack of proactive monitoring. An automated sequence of login attempts can blend in with ordinary activity when there are no intelligent rules to identify unusual volume, suspicious origins, atypical hours for that profile or simultaneous logins. Continuous monitoring turns scattered signals into prioritized alerts, making it possible to investigate the identity before the access escalates into data collection, permission changes or movement across systems.
The third vector is the lack of network segmentation and of access controls proportional to the sensitivity of the information. In a practical scenario, a user who needs to consult a sales application should not automatically gain visibility into financial repositories, human resources files or other customers' data. Segmentation limits the reach of a compromised account, while permission reviews reduce the amount of information available to an identity that is no longer trustworthy.
Layered Protection for Your Infrastructure
The first layer starts with identity. Multi-factor authentication, or MFA, requires a second piece of evidence beyond the password to validate access, reducing the value of a reused or leaked credential. This layer should be accompanied by password policies, privilege reviews and blocking of suspicious attempts. Your company also needs to define which access points are critical and require stricter controls at those points, especially in systems that concentrate customer information.
The second layer combines endpoint protection with EDR, short for Endpoint Detection and Response, continuous patch management and continuous proactive monitoring. EDR watches for suspicious behavior on computers and servers, while patch management reduces opportunities tied to known vulnerabilities. A managed cybersecurity framework can complement the in-house team with visibility, alert correlation and consistent investigation processes.
The third layer prepares for continuity in case prevention is not enough. Isolated, encrypted and regularly tested backup makes it possible to recover information without relying on copies accessible from the same compromised environment. A documented and tested incident response plan defines who decides, who communicates, which access must be contained and how operations will be restored. Backup and disaster recovery resources help turn a promise of recovery into a verifiable capability.
Ongoing training completes these layers by preparing users to recognize unusual requests, fake login pages and access validation requests. The goal is not to shift full responsibility for security onto people. The goal is to reduce opportunities for social engineering and create a clear channel for reporting suspicious behavior before it turns into an incident.
Questions Every Decision-Maker Should Be Asking Now
A mature security decision starts with questions that connect technology, continuity and trust. Evaluate these three questions in sequence before assuming your controls would respond adequately to an identity incident.
Partner/Owner: How long would my company survive without access to its systems and files, and what would that do to customer trust?
C-Level/Manager: Would my backups actually work in a disaster like this, and how quickly would operations be back up and running at a predictable cost?
IT Leader: Does my team have the backup and tools to identify and block an attack like this before disaster strikes, without relying on heroic effort?
How long could my company survive without access to its systems and files, and what would that do to customer trust?
For the partner or owner, the central question concerns the value that has been built over time. System downtime can halt sales, customer service, billing and decision-making, while the exposure of information can weaken the perception of care that sustains business relationships. Continuity must be treated as a component of reputation, not as a technical detail.
Isolated, encrypted and regularly tested backups reduce reliance on improvisation when files and systems need to be restored. An incident response plan also organizes containment, communication and recovery prioritization, preserving leadership's ability to make decisions based on clear information instead of reacting under pressure.
Would my backups actually work in a disaster like this, and how quickly would operations be back up and running at a predictable cost?
For the C-suite and managers, backup only has operational value when it can be recovered within a defined and validated sequence. You need to know which data is a priority, where the copies are isolated, who authorizes the restore and how the company verifies file integrity. Regular testing turns assumptions into practical evidence.
Continuous patch management, ongoing proactive monitoring and network segmentation reduce the likelihood of an outage spreading across the environment. When these controls are combined with a documented response plan, the organization gains the predictability to estimate impact, coordinate vendors and restore services according to business priorities.
Does my team have the backup and tools to identify and block an attack like this before disaster strikes, without relying on heroic effort?
For the IT leader, the issue is sustainable capacity. The team needs EDR to detect and respond to suspicious behavior on endpoints, continuous monitoring to correlate alerts and patch management to reduce the attack surface. These resources allow in-house professionals to focus their time on decisions and improvements that require business knowledge.
Specialized backup does not replace the company's IT team; it strengthens execution with defined processes, visibility and escalation. MFA, access reviews, ongoing user training and response plan exercises reduce reliance on manual actions under pressure, creating a more consistent posture against credential-based attacks.
Frequently asked questions
What is credential stuffing?
Credential stuffing is a technique in which criminals automatically test username and password combinations exposed in other services. The attack relies on credential reuse and can allow access to legitimate accounts when there are no additional controls, such as multi-factor authentication and detection of anomalous attempts.
Does multi-factor authentication eliminate the risk of compromised accounts?
Multi-factor authentication significantly reduces the risk of leaked passwords being misused because it requires additional proof of access. It should work alongside continuous monitoring, privilege reviews, user training and lockout policies to form layered protection.
How can you validate whether backups can restore operations?
Backups must be isolated, encrypted and regularly tested through controlled restores. Validation needs to confirm data integrity, the recovery order of critical systems and the responsibilities set out in the incident response plan.
Check in minutes whether your company would recover from an attack like this: assess your ransomware and recovery readiness.
If your company does not yet have an integrated layered protection strategy, consider getting a no-obligation Strategic IT Assessment to identify vulnerabilities before they make headlines.