Genetic testing giant 23andMe is facing a hefty £2.31 million fine from the UK’s Information Commissioner’s Office (ICO). The penalty follows a 2023 cyberattack that compromised the sensitive data of over 155,000 UK customers.

The ICO’s ruling, published Tuesday, cites serious security flaws as the cause. Specifically, 23andMe failed to implement adequate authentication and verification measures to prevent unauthorized data access. This lapse in security allowed attackers to breach the system and potentially expose highly personal information.

The investigation further revealed a lack of sufficient controls over access to raw genetic data. The ICO also criticized 23andMe’s inadequate systems for monitoring, detecting, and responding to cyber threats. This failure to protect customer data represents a significant breach of British data protection law.

This substantial fine serves as a stark warning to other companies handling sensitive personal information, emphasizing the critical need for robust cybersecurity measures and stringent data protection protocols. The incident underscores the potential vulnerability of genetic data and the far-reaching consequences of inadequate security practices.