23andMe, the leading consumer-facing genetic testing company, is currently in the midst of a massive data breach. On top of that, it is a timebomb with serious financial woes. Last Friday, the company announced a consumer alert. They empowered users by offering a personalized, step-by-step action plan to address their developing financial woes. This occurs as customers have to jump through hoops to delete their private and sensitive genetic data from the company’s easily hackable database. Users were clearly frustrated and confused by the process. They said they waited as long as two hours just to speak with a customer service representative. Still, 23andMe has not answered follow-up emails explaining these issues with customers.
This year, millions of 23andMe customer accounts were hacked as a result of a large-scale data breach. In light of this settlement, the company has agreed to a $30 million settlement resulting from the September breach. Acknowledging these challenges, 23andMe says that they have fixed IT problems resulting from surges in web traffic. Privacy advocates are alarmed that the firm’s upcoming auction on May 14 could involve the company’s customers’ genetic information. Even more troubling, is the privacy and data security implications this prospect presents.
Things got even worse when 23andMe on Sunday filed for Chapter 11 bankruptcy protection. This step is a significant step in the direction of selling the company out of court-supervised process. This possible shift in ownership is what has worried Attorneys General from US states including New York and California. Additionally, California, Arizona, South Carolina, and New York are currently telling 23andMe customers to remove their data from the company’s database.
In recent weeks, customers here, here and here were not so lucky in their efforts to remove their data from the company’s database. Pauline Long, a 23andMe customer, went through the same steps several times before being able to access her account, beginning early Tuesday morning. She did manage to delete her account completely by Tuesday evening. Even that didn’t assuage her fears of whether her info was really deleted for good.
Danielle Landriscina, another customer who signed up for 23andMe in 2018 to connect with her father's side of the family, expressed concerns about her data's fate in light of the potential sale.
"If 23andMe is going to be sold, then my data can be sold, from what I hear," said Danielle Landriscina.
We recently caught up with Michele Lewis, who used a 23andMe test kit back in 2008. This go around, she realized it was easier to delete her data than on her first tries.
"It was much easier and it was deleted almost immediately," she noted.
Lewis expressed her discomfort about privacy concerns.
"I have never really been too worried about privacy issues or hacking or anything, but this isn't the first time 23andMe has had issues," she remarked.
The 23andMe spokesperson noted that if users are facing issues, they should contact support through the company’s customer care portal.
"If anyone has any issues in regards to accessing their account or deleting their data, they can go to our customer care site for support," stated the spokesperson.
In the wake of the warning issued by AG Bonta, we have some advice for impacted 23andMe users about their rights and options.
"It's up to them what they do, but I wanted to advise them of their right to delete," said California Attorney General Rob Bonta.
He illustrated that each person needs to balance their own privacy with the risk of what might happen.
"Every individual will have a different appetite for risk and will value their own private information differently," Bonta added.
As speculation about 23andMe’s future continues, many consumers are left wondering if they’d take the same gamble today. Landriscina looks back on her time with the company and wishes she could go back and change things.
"If I had to do it all over again, I would not have done this," she confessed.