[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fIOQZb0VCABNPc8q8E8P4A23BVOKQRFEvHmcGLcAhBGg":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":25,"status":26,"created_at":27,"published_at":28,"article":29,"tags":33,"podcasts":52,"controls":53},"934f0cae-2aa4-475d-9e41-c9929c3e50f4","23andme-fined-24m-after-credential-stuffing-attack-exposes-genetic-data-of-spanish-users","b846b5fb-f89f-453f-a275-002f65009670","23andMe Fined €2.4M After Credential-Stuffing Attack Exposes Genetic Data of Spanish Users","The 2023 credential-stuffing attack on 23andMe succeeded because the company failed to enforce fundamental access controls — specifically mandatory multi-factor authentication, strong password policies, and rate limiting — leaving sensitive genetic, health, and ethnic origin data exposed. This matters because genetic and biometric data represent some of the most irreversible personal information a person can expose; unlike passwords, DNA cannot be changed. Compounding the technical failures, 23andMe also breached GDPR's 72-hour breach notification requirement, demonstrating a failure in incident response preparedness. Regulators increasingly treat the absence of basic security hygiene as negligence, not misfortune, especially when highly sensitive special-category data is involved.","**Immediate actions:**\n- Enforce mandatory multi-factor authentication (MFA) for all user accounts, especially those holding special-category data such as genetic or health information.\n- Implement rate limiting and account lockout mechanisms on all authentication endpoints to block automated credential-stuffing tools.\n- Audit existing password policies and enforce minimum complexity requirements, rejecting known breached passwords using services like HaveIBeenPwned.\n\n**Incident Response improvements:**\n- Establish and rehearse a documented breach notification workflow that guarantees regulatory bodies are notified within the 72-hour GDPR window.\n- Assign a dedicated Data Protection Officer (DPO) with clear authority and a pre-approved communication template for supervisory authority notifications.\n\n**Long-term data protection measures:**\n- Apply data minimisation and strict role-based access controls so that aggregated genetic datasets are never unnecessarily linked to identifiable personal information.\n- Conduct annual penetration tests and threat modelling exercises specifically targeting authentication flows for platforms storing special-category personal data.\n- Implement continuous anomaly detection on login patterns to identify and alert on credential-stuffing attempts in real time.",[12,13,14,15,16,17,18,19,20,21,22,23,24],"GDPR Article 5(1)(f) – Integrity and confidentiality principle","GDPR Article 9 – Processing of special categories of personal data","GDPR Article 25 – Data protection by design and by default","GDPR Article 32 – Security of processing","GDPR Article 33 – Notification of a personal data breach to the supervisory authority (72-hour rule)","NIST SP 800-63B – Digital Identity Guidelines (MFA, password strength)","NIST AC-7 – Unsuccessful Logon Attempts (rate limiting\u002Flockout)","NIST SI-10 – Information Input Validation","CIS Control 5 – Account Management","CIS Control 6 – Access Control Management","CIS Control 17 – Incident Response Management","ISO\u002FIEC 27001:2022 – A.8.5 Secure authentication","OWASP Credential Stuffing Prevention Cheat Sheet",{},"published","2026-07-24T16:20:55.43428+00:00","2026-07-24T16:20:55.147+00:00",{"id":7,"url":30,"slug":31,"title":32},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AEPD_(Spain)_-_PS-00140-2025&diff=52492&oldid=52491","aepd-spain-ps-00140-2025-60bd0d","AEPD (Spain) - PS-00140-2025",[34,40,46],{"id":35,"name":36,"slug":37,"description":38,"color":39},"182e11d5-57c4-444e-8ec8-4682ad60261b","Incident Response","incident-response","Slow detection, poor containment, missing playbooks","#14b8a6",{"id":41,"name":42,"slug":43,"description":44,"color":45},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":47,"name":48,"slug":49,"description":50,"color":51},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[54,58,62],{"slug":55,"name":56,"problem":57},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":59,"name":60,"problem":61},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":63,"name":64,"problem":65},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control."]