Data protection watchdogs in Canada and the UK have announced a joint investigation into a data breach at genetics testing company 23andMe that affected seven million customers in 2023.

Since 2006, San Francisco-based genetic testing company 23andMe has sold over 12 million DNA testing kits. It analyses customers’ saliva to provide insights into health and ancestry.

In October 2023, 23andMe reported a security breach in which hackers gained access to the personal information of millions of customers by using old passwords. In some cases, the information accessed included family trees, birth years and geographic locations.

The Information Commissioner's Office (ICO) in the UK and the Office of the Privacy Commissioner of Canada (OPC) will examine the scope of information that was exposed by the breach and potential harms to affected people.

John Edwards, the UK information commissioner, said: “People need to trust that any organisation handling their most sensitive personal information...