Privacy commissioner Philippe Dufresne and his British counterpart John Edwards announced they’re working together to probe a 2023 hack at the U.S.-based consumer genetic testing service, which exposed “highly sensitive” private data of an estimated 6.9 million users. The investigation is to examine the scope of the stolen information, whether 23andMe had adequate safeguards and whether it properly notified the authorities of the breach. (The Logic)

Talking point: The last point may be the crucial one: information about the hack dripped out over months, starting in October. The attack began by compromising about 14,000 accounts using “credential stuffing”: trying passwords previously hacked from other online services to see if victims had reused them. But the hackers got many, many others’ data through 23andMe services for finding relatives through DNA matches.