Regulator announcement; this article does not establish payment or the outcome of any subsequent appeal.
What happened
The ICO announced a £2.31 million fine against 23andMe in June 2025 following a credential-stuffing attack in 2023. The regulator described failures to protect the personal information of 155,592 UK users. The attack used credentials stolen in unrelated breaches. The case was investigated jointly with Canada’s privacy authority.
Source: ICO — original source ↗
What it means for your website
People reuse passwords, and a website needs to plan for predictable behaviour. Consider the sensitivity of what an account can reveal or download, not just the difficulty of guessing its password. Administrative access and sensitive exports deserve particular attention. For website owners, a practical starting point is to ask which actions require additional verification and how suspicious login patterns are handled. Do not send customer passwords to a developer for testing. Use agreed test accounts and review the authentication setup separately from cookie consent. The public GDPRFix scanner does not attempt account compromise or assess the full security of a login system.
Three useful next steps
- Review protection for administrators and sensitive downloads.
- Check monitoring for repeated or unusual login attempts.
- Use controlled test accounts for security investigations.
Sources & context
Official sources consulted on 1 October 2026. A regulator’s announcement records its findings at that time; it is not proof of payment or the outcome of every later appeal.
ICO — original sourceOur practical suggestions are GDPRFix commentary. A public website scan cannot establish your full legal position. For advice on a specific obligation or enforcement matter, use a suitably qualified adviser.