23andMe’s Data Security Catches Attention of House GOP
A trio of lawmakers want answers from 23andMe about the security of its customer data.
In a letter to the bankrupt genetic testing service Thursday (April 17), members of the House Committee on Energy and Congress expressed concerns that this data could be compromised following a sale.
The letter from Rep. Brett Guthrie of Kentucky, Rep. Gus Bilirakis of Florida and Rep. Gary Palmer of Alabama said that generally speaking, direct-to-consumer firms such as 23andMe are not covered by the Health Insurance Portability and Accountability Act (HIPAA).
“Given the lack of HIPAA protections, the patchwork of state laws covering genetic privacy, and the uncertainty surrounding what happens to customer information should a sale of the company or customer data transpire, we are concerned that this trove of sensitive information is at risk for being compromised,” the letter said.
In addition, users have complained of difficulties in accessing their data, whether that meant the website being down or never getting the two-step verification codes needed to delete their accounts.
PYMNTS did not receive a response from 23andMe to a request for comment.
The company said in a March 26 press release that it was seeking Chapter 11 bankruptcy protection and searching for a buyer. Days later, the company said that the terms of its sale would require bidders to “agree to comply with 23andMe’s consumer privacy policy and all applicable laws with respect to the treatment of customer data.”
Last year, the company said it would pay $30 million to settle a lawsuit tied to a data breach, while also agreeing to provide three years of security monitoring as a result of the class-action litigation. That suit had accused 23andMe of failing to protect the private information of nearly 7 million customers exposed in the breach in 2023.
The settlement also resolves allegations that 23andMe did not inform customers with Chinese and Ashkenazi Jewish ancestry that a hacker had apparently targeted them specifically, selling their information on the dark web.
The company revealed the data breach in October 2023, roughly six months after it began, impacting nearly half of the 14.1 million customers in 23andMe’s database at the time.
The incident and other data breaches underscore the need for service providers to secure their infrastructure.
The post 23andMe’s Data Security Catches Attention of House GOP appeared first on PYMNTS.com.