Senior Accountant

California AG sues 23andMe over 2023 breach exposing health data. 01 Jun 2026 Three separate news alerts hit the radar today, and together they paint a telling picture. California AG sues 23andMe over 2023 breach exposing health data. It is the kind of story that deserves proper context. Because understanding how it happened is the only way to stop the next one. Here is the breakdown that matters. News sites tend to report the event. The question is what it means. That gap between reporting and understanding is exactly why these briefs exist. This is what the press release does not say. California AG sues 23andMe over 2023 breach exposing health data was reported by BleepingComputer. The surface-level explanation only tells part of the story. Digging deeper reveals patterns that repeat across incident after incident. Why defences failed to catch it. * Gaps in coverage: The tool stack was impressive, but the seams between tools were invisible to defenders. * Alert fatigue: Too many warnings, too few analysts - the real signal was buried in noise. * Assumed trust: Internal traffic or third-party connections were not inspected with the same rigour as external threats. * Process gaps: Patch cycles lagged, reviews were rushed, and exceptions became the norm. There is a temptation to dismiss each breach as a one-off. But the pattern is consistent: small oversights compound into catastrophic failures. The systemic issue. You have probably seen the corporate response playbook by now: acknowledge, downplay, promise an investigation, wait for the next news cycle. It is not helpful. What is often missing from the conversation is the human layer. The CFO who disables MFA to save ten seconds. The developer who hardcodes credentials because it is faster. The server that everyone knows is outdated but nobody owns. This is where incidents are born. A brutally honest risk assessment - not the checkbox kind, but the kind that makes you want to fix something immediately - is the most valuable investment you can make. New russia-linked GREYVIBE targets ukraine with ai-powered cyberattacks. Each story like this is a data point. Collect enough of them and the picture becomes harder to ignore. Three recurring themes seem relevant here: * Trust exploitation: Attackers do not break encryption - they break the trust placed in people, processes, or systems. * Speed over scrutiny: The pressure to ship, deploy, or publish often overrides the time needed to verify. * Posture drift: Defences are often strong at implementation and weak at maintenance. What was true in January is no longer true in May. Asia's Cyber Insurance Market Shows Signs of Life. A different angle on the same landscape. Asia's Cyber Insurance Market Shows Signs of Life, reported by Dark Reading. The cyber insurance industry has made relatively weak inroads into Asia due to a a variety of factors, but that could be changing. On its own this might not seem like a critical story. But patterns do not emerge from outliers - they emerge from frequency. And this pattern is showing up with increasing regularity. The uncomfortable truth is that most of these incidents share a common origin: a small decision that seemed harmless at the time. A skipped review. A delayed patch. A credential shared for convenience. Individual moments, but they stack up. The question is not whether attackers are getting smarter. It is whether defenders are getting complacent. If your security posture has not been materially improved in the last six months, it has probably degraded - because the threat landscape certainly has not stood still. Why these stories matter as a group. Treated separately, each breach is a headline. Together, they are a trend. The threat actors dominating 2025 and 2026 are not the same as those of 2020. They are organised, patient, and funded in ways that resemble legitimate businesses more than opportunistic hackers. A useful exercise: pick one control in your environment and ask honestly whether it is still effective. Not whether it is configured - whether it is actively stopping threats. Most organisations find at least one that is decorative rather than functional. Resilience does not require perfection. It requires preparation. Can you detect quickly? Can you isolate effectively? Can you restore cleanly? If the answer to any of those is uncertain, that is your next priority. Practical steps worth taking. The difference between an aware organisation and a secure one is the gap between knowing and doing. Let Sweat Digital close it. Immediate priorities. * Audit privileged accounts. Who holds admin rights? When was the list last reviewed? If you cannot answer within thirty seconds, that is a finding. * Push MFA everywhere. No exceptions. Executive convenience is not a justification for single-factor access. * Patch public-facing assets first. VPN, gateway, web server - if it touches the internet and it is not current, it is a priority. * Restore a backup. Time it. If it takes more than two hours, your backup strategy is aspirational, not operational. * Review logging coverage. Authentication, DNS, file access, privilege use. If any of those is unlogged, detection is blind. Building resilience. * Segment your network. If one compromised endpoint can reach your domain controller, your segmentation is inadequate. * Operationalise EDR alerts. Alerts without response are noise. Define who acts, how quickly, and under what conditions. * Run phishing simulations. Then deliver targeted training. Measure click-rate reduction over time. * Review third-party access. Vendors, contractors, integrations - if the access is not actively needed, revoke it. * Update your IR playbook. Make it usable at 3 AM. Role cards, contact trees, decision trees. Not a PDF nobody reads. The practical takeaway. Reading about breaches is easy. Acting on them is the hard part. If these headlines prompted even one change in your environment today, they have served their purpose. Security is built in small increments: one account reviewed, one patch applied, one person trained. That is enough. For today. Until next time - stay vigilant, stay grounded, and keep questioning assumptions. Loading...

California attorney general sues 23andMe for data breach. * Caroline Petrow-Cohen, Los Angeles Times * May 30, 2026 Updated 20 hrs ago The California attorney general filed a lawsuit Thursday against the company formerly known as 23andMe, accusing the genetic testing service of failing to protect customers' data during a 2023 breach. The data breach affected nearly 7 million people across the country, including more than 850,000 Californians, according to a release from Attorney General Rob Bonta's office. The exposed data contained sensitive material such as raw genetic information and health reports. Hackers listed the data for sale on the dark web in 2023, Bonta said. The business 23andMe filed for bankruptcy last year and was acquired by TTAM Research Institute, a nonprofit led by the company's former Chief Executive Anne Wojcicki. Bonta filed suit against Chrome Holding Co., a subsidiary of TTAM and the corporate debtor name that 23andMe operated under during bankruptcy. "23andMe collected genetic data about millions of people, failed to meet its obligation under California law to keep that information safe, and then lied to consumers about the severity of its 2023 data breach," Bonta said in a statement. A 2023 investigation by the California Department of Justice found that the hackers were able to operate within 23andMe's systems for five months without being detected. 23andMe only began investigating once the data were offered for sale on the dark web, the investigation found. The hackers used a common tactic known as credential stuffing to access the data, which exploits weak and reused passwords. "Businesses, particularly those that collect and maintain sensitive personal and genetic data, can and should know to guard against" credential stuffing, the attorney general's release said. According to the complaint filed in the San Francisco Superior Court this week, 23andMe "misled consumers and failed to take obvious steps necessary to safeguard its customers' sensitive personal information." 23andMe was founded in San Francisco in 2006 and popularized at-home genetic testing, allowing customers to send in a saliva sample and receive a DNA analysis. At its peak, 23andMe was valued at $6 billion and attracted celebrity attention, holding "spit parties" where high-profile customers spit into a tube to provide their DNA sample. The samples helped people discover entirely new family trees and could reveal consequential health information, such as a genetic predisposition to cancer. After its promising rise, however, the company began seeing signs of trouble. Because users need to provide a DNA sample only once to use 23andMe's services, the company failed to establish a sustainable business model based on repeat customers. Additionally, 23andMe struggled to license its tech to pharmaceutical companies, which could have boosted profits. By the time the company filed for bankruptcy in March 2025, it had collected around 15 million DNA samples. The attorney general has a separate, pending legal challenge in the U.S. Bankruptcy Court for the Eastern District of Missouri regarding the sale of Californians' genetic information and material in bankruptcy. (0 Ratings)

23andMe inherits lawsuit over 'disturbing' DNA data breach. May 29, 2026 - 22:12 California AG claims genetics biz downplayed 2023 mega-leak while paying ransom to attacker The office of Rob Bonta, California's attorney general, is suing 23andMe for the data protection failings that led to the genetics company's disastrous 2023 breach. Bonta and his team claim [PDF] that 23andMe failed to implement adequate security controls for the sensitive records it stored, and misled customers about the nature of the mishap after the fact. "23andMe collected genetic data about millions of people, failed to meet its obligation under California law to keep that information safe, and then lied to consumers about the severity of its 2023 data breach," said Bonta on Thursday. "Its investigation found that the company failed to take basic steps to protect users' data - data including the sensitive personal information, family histories, and health conditions of consumers "The sale of this data on the dark web took place amidst a period of mounting anti-Asian American and Pacific Islander and antisemitic hate and violence - and explicitly called attention to the deeply personal and identifying nature of that information. This is disturbing and incredibly dangerous. Today, my office is suing 23andMe for its categorical failure to comply with California law." The lawsuit was filed against Chrome Holding Co., formerly known as 23andMe. TTAM Research Institute bought 23andMe's assets last year. TTAM Research Institute was founded and is led by Anne Wojcicki, who was also 23andMe's CEO at the time of the breach and one of the company's co-founders. The nonprofit's purchase of 23andMe assets was completed on July 14, 2025, at which time it promised to run 23andMe charitably, using its data to further medical research and education. 23andMe continues to operate as it always did, taking customers' saliva samples and turning it into fun insights, such as what percentage of their makeup is Neanderthal, and whether their DNA makes them more or less likely to enjoy a scattering of cilantro on their food. 'Disturbing' Announcing the lawsuit, Bonta's office used "disturbing" no less than three times to describe the events that transpired before and after 23andMe's mega breach. To recap, a cybercriminal going by the name Golem popped up on a forum in 2023 claiming to offer a slew of data belonging to millions of 23andMe customers. Investigations carried out by regulators later found that Golem only breached around 14,000 accounts, but because of 23andMe's DNA relatives feature, which allows users to connect with other 23andMe users who share a percentage of the same DNA, the crook was able to access the details of nearly 7 million customers. It also soon emerged that 23andMe failed to spot the intrusion for five months, and the 14,000 or so accounts Golem accessed were compromised as a result of credential-stuffing attacks. What followed was a multi-faceted game of finger-pointing. 23andMe's decision to blame customers for recycling credentials instead of admitting it should have mandated 2/MFA on all accounts by default went down about as badly as one might expect. To this day, 23andMe allows customers to use its service without 2/MFA, although it issues regular prompts to those who don't have it set up. Regulators, on the other hand, highlighted that the company's security practices were less than perfect, while security experts were divided. Many agreed there was blame to be placed on both sides. Then came the fines and the settlements. The UK's Information Commissioner hit the company with a £2.3 million ($3.09 million) fine in June 2025, three months after the bankruptcy filing. In its ruling, it echoed the findings of US authorities from 2023, accusing the company of relying on inadequate password requirements. The Information Commissioner rebuked 23andMe for failing to detect the intrusion promptly and not implementing measures to prevent bulk downloading of genetic data. Bonta's office alleged that 23andMe's statements to customers were "misleading and omitted or misrepresented critical information." "While 23andMe assured the public that it had not experienced a data security incident within its systems, downplayed the sensitivity of the stolen data by claiming that the information stolen from the 'DNA Relatives' feature was essentially public, and attempted to shift blame for the breach to its customers, 23andMe was simultaneously negotiating and paying a ransom to the threat actor in exchange for, among other things, the threat actor removing damaging information regarding the breach that had been posted online and providing information about multiple 23andMe security vulnerabilities, including vulnerabilities the threat actor exploited during the data breach." The Register contacted 23andMe's publicists for a response. Ranzware inc. only received one on behalf of the 23andMe Research Institute, which despite managing requests directed to the 23andMe platform's only press contact address, distanced itself from Chrome Holding, which, like TTAM Research Institute, does not have a public-facing contact. It also did not help Ranzware inc. contact 23andMe's operator. The institute said: "The 23andMe Research Institute is a newly established independent nonprofit organization and is not involved in the matters described in the California Attorney General's complaint filed against Chrome Holding Co., formerly known as 23andMe. The lawsuit pertains to events and operations associated with the former commercial entity prior to the creation of the 23andMe Research Institute. The institute was not involved in the complaint and has no role in the underlying litigation. "The 23andMe Research Institute is focused on advancing nonprofit scientific and health research with a strong commitment to privacy, ethics, transparency, and responsible data stewardship."(R)