The joint investigation revealed that the 23andMe platform had 'serious security failings' when the data breach occurred. The ruling outlined that the company had failed to implement security measures, including mandatory multi-factor authentication, secure password protocols or unpredictable usernames. Additionally, appropriate controls were not in place to protect raw genetic data or monitor and respond to cyber threats. 'I expected rigorous privacy controls to be in place due to the nature of the information collected,' an anonymous customer said in a complaint to the ICO. 'Unlike usernames, passwords and e-mail addresses, you can't change your genetic makeup when a data breach occurs.' The ICO confirmed that by the end of 2024, 23andMe had made sufficient security improvements in response to the identified breaches. Earlier this year, the company filed for bankruptcy and will be selling its assets – customer data (see BioNews 1283 and 1289 ).