2026-08-12

Should you encrypt your 23andMe raw DNA data file before storing or sharing it?

Most advice about protecting a sensitive file assumes you can eventually change the thing it protects — rotate a password, cancel a card, close an account. A raw DNA data file breaks that assumption completely. You can download it, delete the account that generated it, and store it somewhere safer — but the genetic sequence inside it is the one credential you will never be able to reissue. That permanence is exactly why the last few years of 23andMe's own history are worth understanding before deciding where that file ends up.

What a 2023 breach actually cost the company, three years later

In October 2023, 23andMe disclosed that attackers had gotten into user accounts through credential stuffing — reusing usernames and passwords leaked from unrelated sites until some of them worked. Only around 14,000 accounts, under 0.1% of 23andMe's roughly 14 million customers at the time, were directly compromised this way. But those accounts were enough: attackers used them to scrape the opt-in "DNA Relatives" and "Family Tree" sharing features connected to them, reaching about 6.9 million people's ancestry and relative-matching data in total. 23andMe forced a password reset and made two-step verification mandatory — it had been optional before. Almost three years later, on July 14, 2026, forty-three state attorneys general announced an $18 million multistate settlement over that same breach. New York's own share came to over $705,000, covering 305,245 New York customers alone. The settlement's own list of what went wrong is specific: no requirement for multi-factor authentication, no credential blocklisting, insufficient rate limiting or intrusion prevention, no logging or monitoring capable of catching the breach in progress. New York Attorney General Letitia James put it plainly: "New Yorkers trusted 23andMe with their sensitive and personal genetic data, only to find that data stolen and put up for sale on the dark corners of the internet."

The breach didn't end when the notice letters went out

23andMe filed for bankruptcy on March 23, 2025. The genetic database built from those 15+ million customers — the actual asset — went up for sale as part of that filing, and in July 2025 it closed: TTAM Research Institute, founded by 23andMe's own former CEO, acquired it for $305 million. A separate US consumer class-action settlement, working through the same bankruptcy proceedings, started at $30 million with preliminary approval in December 2024 and was later proposed at closer to $50 million — still unresolved as of this writing, years after the original breach. The Electronic Frontier Foundation published a guide in March 2025, directly because of the bankruptcy, recommending that concerned users download their data and delete their account before ownership changed hands again. EFF didn't mince words about the stakes: "Our DNA contains our entire genetic makeup. It can reveal where our ancestors came from, who we are related to, our physical characteristics, and whether we are likely to get genetically determined diseases." But EFF's own security advice for the file you're told to download stops at one sentence: "If you do so, be sure to store it securely." No method is specified. That's the actual gap this post is about.

Why this file deserves more caution than a password ever does

A leaked password gets rotated. A raw DNA file cannot be — it's the same sequence for the rest of your life, and it also describes blood relatives who never created a 23andMe account or agreed to anything. The legal protection most people assume exists is narrower than it sounds: the federal Genetic Information Nondiscrimination Act (GINA) covers only health insurance eligibility and employment decisions. It explicitly does not apply to life insurance, disability insurance, or long-term-care insurance — insurers selling those products can legally use genetic information the same way they'd use any other health data, in the states that haven't separately closed that gap themselves. A file that reveals disease predisposition isn't just a privacy concern in the abstract; it's information a large category of insurers is free to act on, indefinitely, once it's out.

What "store it securely" should actually mean

Downloading your raw data and deleting your account, as EFF and others recommend, only fixes where the data lives — not what shape it's in once it gets there. A plaintext .txt file sitting in a personal cloud drive, a shared family folder, or an external drive is exactly the kind of target credential stuffing and misconfigured sharing links are built to reach; nothing about moving the data off 23andMe's servers changes that on its own. The concrete version of "store it securely" is to encrypt the file itself, locally, with a passphrase only you (or the family members you choose) know — before it ever gets backed up, synced, or shared — so that whatever eventually happens to the storage location around it, what's actually sitting there is unreadable without that passphrase.

Where NearSeal fits

NearSeal encrypts a file entirely in the browser — the file and the passphrase never leave the device, and there's no account or server anywhere in the process, which matters specifically here since the point is not repeating 23andMe's own upload-and-trust model with a different company. The default format derives an AES-256-GCM key from your passphrase via PBKDF2-SHA256 at 2²⁰ iterations; the optional age-encryption.org format uses scrypt and ChaCha20-Poly1305 instead, and opens with the standard age or rage CLI too, which matters if you want a sibling or parent to be able to open the same file with their own tools years from now. What NearSeal can't do is undo the 2023 breach, change what GINA covers, or decide who ends up owning a database that's already been sold once. What it can do is make sure that the one copy of your raw genetic data you actually control — the one sitting on your own device after you've downloaded it — isn't plaintext waiting for the next misconfigured link or reused password to find it.