MOUNTAIN VIEW, California – Genetic testing company 23andMe reported a major security breach, affecting nearly half of its 14 million users, the company announced in a regulatory filing on Friday. The breach, which occurred in early October, resulted in the exposure of the personal data of about 6.9 million individuals, which included DNA ancestry information.

The company disclosed that “threat actors” had accessed the personal information of about 14,000 customers, but also warned that a “significant number of files containing profile information about other users’ ancestry” had also been compromised. Additionally, about 1.4 million people who had opted in to 23andMe’s DNA relatives feature had their family tree profile information accessed.

According to a statement from 23andMe, the breach was a result of unauthorized access to individual accounts through an opt-in feature that allows DNA-related relatives to contact each other. The company also acknowledged that information including names, relationship labels, birth year, self-reported location, and other data had been accessed.

Reports indicate that a sample of data points from 23andMe accounts was exposed on a black-hat hacking crime forum two months ago. This sample reportedly contained 1 million data points exclusively about Ashkenazi Jews and hundreds of thousands of users of Chinese heritage, and hackers began selling 23andMe profiles for as little as $1 per account.

Following the breach, the company speculated that the breach was likely caused by customers reusing passwords that had appeared in other data breaches, allowing hackers to use a technique known as “credential stuffing.”

The fallout from the breach continues to unfold as 23andMe works to address the security breach and its impact. The company’s response and the protection of its user data will undoubtedly be closely monitored moving forward.