The Conventional Wisdom
When a major breach makes the news, privacy officers often look to settlement terms for guidance. The 23andMe case is no exception: an $18 million penalty, mandatory risk analysis, an advisory board, and continued deletion rights for consumers. The typical takeaway? Implement these controls, pass your next audit, and you've addressed the gap.
This approach treats regulatory settlements as security blueprints. Add multi-factor authentication (MFA), document your risk assessments, create an oversight committee. Check the boxes, close the finding, move on.
Why This Approach Falls Short
Settlement mandates don't create security. They document what broke after the fact.
23andMe's breach wasn't due to missing controls on paper. The company offered MFA before the October 2023 credential stuffing attack that exposed over six million users' ancestry data. The problem was adoption. Customers didn't enable it, and the company didn't enforce it for accounts holding special category data.
No settlement term fixes that gap. You can't mandate your way out of a design failure or a cultural one.
The required "appropriate risk analysis" sounds reasonable until you realize 23andMe likely had risk analysis documentation before the breach. Most regulated companies do. What they lack is the operational discipline to act on identified risks before an incident forces their hand. The settlement creates a compliance artifact, not a security improvement.
Consider the Advisory Board requirement. Boards provide oversight, but they don't write code, configure authentication policies, or decide to disable password-only access for genetic data accounts. That's an engineering and product decision, requiring someone with authority to accept the friction it creates.
The settlement also mandates that TTAM Research (the non-profit that acquired 23andMe's customer data during bankruptcy proceedings) continue offering deletion rights. That's consumer protection, not breach prevention. Deletion rights matter, but they don't stop credential stuffing or prevent the next compromise.
The Evidence
The New York Attorney General's statement emphasized "flimsy security measures" and a "duty to protect." The settlement doesn't specify what made the measures flimsy. It doesn't require enforcement of MFA, rate limiting on authentication attempts, or device fingerprinting to detect credential stuffing patterns.
The breach happened because attackers used stolen credentials from other breaches to access 23andMe accounts. This is a known attack vector with known mitigations. The Spanish privacy watchdog fined the company €2.4 million, and the UK's Information Commissioner's Office issued a £2.3 million penalty for failing to protect special category data. Multiple regulators identified the same control gap, yet the settlement focuses on governance artifacts rather than technical enforcement.
Contrast this with what would actually prevent credential stuffing: mandatory MFA for all accounts, not optional MFA buried in settings. Anomaly detection that flags logins from new devices or locations when accessing genetic data. Rate limiting that blocks rapid authentication attempts. Session management that invalidates tokens after password changes elsewhere.
None of these appear in the settlement terms because settlements address legal violations, not operational security. The violation was failing to protect customer data. The remedy is paying $18 million and documenting your processes better. But better documentation doesn't block malicious logins.
What to Do Instead
If you're treating regulatory settlements as your security standard, you're designing for the last breach, not the next one.
Start with threat modeling specific to your data types. Genetic information is special category data under GDPR and the UK General Data Protection Regulation. It's sensitive personal information under the California Privacy Rights Act. That classification should trigger mandatory controls, not optional ones. If your threat model identifies credential-based attacks as a material risk to special category data, make MFA non-negotiable for those accounts.
Second, enforce controls at the platform level, not the user preference level. Deletion rights belong in a preference center. Authentication requirements don't. If you're storing biometric data, financial records, or health information, the user shouldn't choose whether to enable MFA any more than they choose whether you encrypt data at rest.
Third, measure adoption, not availability. 23andMe offered MFA. That's not the same as ensuring it protected the accounts that mattered most. Instrument your authentication flows. Track what percentage of accounts holding special category data use password-only access. Set a target, enforce it, and report it to your board before a regulator asks.
Fourth, test your controls against known attack patterns. Credential stuffing isn't novel. Run tabletop exercises where your security team simulates the attack and your monitoring team tries to detect it. If your current tooling wouldn't flag the pattern, you know where to invest.
Finally, separate compliance artifacts from security controls in your program roadmap. Risk analysis documentation satisfies regulators. Automated account lockouts after failed login attempts stop attackers. Both matter, but they're not interchangeable.
When the Conventional Wisdom Is Right
Settlement terms do serve a purpose. They establish a regulatory floor and signal enforcement priorities. The 23andMe settlement shows that supervisory authorities will pursue penalties for special category data breaches and that bankruptcy doesn't shield you from prior violations (though California's July 2025 claim for monetary relief was blocked by the Chapter 11 reorganization plan, the coalition's settlement proceeded).
The required Advisory Board creates accountability. If you don't have executive-level oversight of data security decisions, you're more likely to deprioritize friction-inducing controls until after a breach. Governance structures matter when they come with authority and consequences.
And the settlement's emphasis on deletion rights addresses a real consumer protection gap. During bankruptcy proceedings, customer data becomes an asset. The coalition's intervention ensured that TTAM Research remains bound by deletion obligations, which prevents genetic data from being treated as a liquidation asset without consent.
But none of this replaces the hard work of enforcing MFA, detecting anomalies, and designing systems that assume credentials will be compromised. Settlements tell you what regulators will punish. Your threat model tells you what attackers will exploit. Build for the latter, document for the former, and don't confuse the two.
