Spain Fines 23andMe €2.4 Million Over Security Failures Behind 6.9 Million

Cybersecuritynews •Abinaya • July 22, 2026

Spain’s data protection authority has fined the genetic testing company 23andMe €2.4 million due to security failures linked to a data breach in 2023. This incident exposed highly sensitive information such as genetic, health, ethnicity, and family-related data belonging to over 2,600 individuals in Spain. The penalty follows a significant credential-stuffing attack that compromised data […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Spain Fines 23andMe €2.4 Million for 2023 Data Breach Spain's data protection authority has imposed a €2.4 million fine on 23andMe due to security failures that led to a data breach in 2023. The breach exposed sensitive genetic, health, and family-related information of over 2,600 individuals in Spain, part of a larger incident affecting 6.9 million users globally. The breach was attributed to a credential-stuffing attack, which allowed unauthorized access to user accounts. The fine was announced by the Agencia Española de Protección de Datos (AEPD) on July 21, 2026, highlighting the serious implications of inadequate cybersecurity measures. This incident emphasizes the need for robust security protocols in handling sensitive personal data. 2 sources 52

Extracted Entities

Spain Fines 23andMe €2.4 Million Over Security Failures Behind 6.9 Million

The full story

Extracted Entities

Attack Types (2)

Companies (1)

Countries (1)

MITRE ATT&CK (1)