Tech Disputes Update: ICO Fines 23andMe

The ICO's £2.31m fine against 23andMe for a major data breach is a stark reminder of the regulatory consequences that can result from cybersecurity incidents, in addition to the financial and reputational damage caused to businesses by the incident itself. The consequences of inadequate cybersecurity measures can be existential for the businesses involved in such incidents. Organisations handling sensitive personal data should prioritise robust protections to avoid similar pitfalls.

The Information Commissioner's Office (ICO) has imposed a £2.31m fine on genetic testing company 23andMe for failing to implement adequate security measures following a major cyber-attack in 2023. The penalty follows a joint investigation by the ICO and the Office of the Privacy Commissioner of Canada. This comes on top of the financial and reputational damage to 23andMe caused by the attack which appears to have been a major contributing factor in driving the business to bankruptcy,