The Show on KJZZ

Listen live weekdays at 9 a.m.

Mayes: 23andMe broke Arizona law by not notifying officials about data breach

By Camryn Sanchez
Published: Thursday, January 11, 2024 - 4:37pm
Updated: Friday, January 12, 2024 - 8:13am

Kris Mayes
Gage Skidmore/CC BY 2.0
Kris Mayes in 2022.

Arizona’s attorney general says a DNA analysis company violated state law by not informing state officials of a data breach that affected millions of its customers.

Hackers stole personal information about millions of 23andMe clients last October. Attorney General Kris Mayes wrote a letter to the company last week requesting more information about the breach, including a detailed list of the number of Arizonans affected. 

Mayes noted that data about people with Jewish and Chinese heritage was sold on the dark web. 

“The hacking of sensitive data identifying specific racial or ethnic groups is particularly reprehensible given the national rise in hate crimes, including anti-Semitic and anti-Asian incidents,” Mayes is quoted in a press release.

She also wrote that 23andMe violated a state law that mandates companies notify the attorney general and Arizona Department of Homeland Security of similar data breaches. The law states that companies doing business in Arizona who experience a data breach must notify the offices within 45 days of discovering the breach.

Officials with 23andMe announced that customers’ personal information had been leaked on Oct. 6, and they concluded an internal investigation on Dec. 1.

“Such attacks are predictable events that data security architects should anticipate, particularly if they boast of data security measures while seeking consent from consumers to collect, use and sell data,” Mayes wrote.

Mayes’ spokesperson Richie Taylor said the Attorney General’s Office is not working with other states, so it’s not clear if any other states have made similar requests of the company. 

There is no timeline by which Mayes asked for a response. The company did not respond to Mayes’ letter, or a request for comment on Thursday.

More stories from KJZZ

BusinessPolitics Retail + Consumer