The company said it had reported the matter to law enforcement and that this was the first incident of its kind at the firm.
The data does not include genomic details, which are especially sensitive, but does include usernames, regional locations, profile photos, and birth years. The usernames are often something other than full legal names.
23andMe said it was encouraging users to change their passwords and use two-factor authentication to prevent others from logging in under their name.
Online posts offering the data for sale in underground forums said buyers could acquire 100 profiles for $1,000 or as many as 100,000 for $100,000. One post said the person had uploaded a large database of Ashkenazi Jews. The company spokeswoman said that would include people with even 1% Jewish ancestry.
Some of the posts used the handle “Golem,” a reference to a humanoid beast in Jewish folk tales.
The data taken from 23andMe could cover more than half of the company’s 14 million customers, based on the number of people who have opted to make their data visible to relatives, including distant cousins.
While the reference to Jews might have been designed to draw attention and increase the odds of transactions, it comes during a time of increased rhetorical and physical attacks on Jews in the United States. Antisemitism has gotten more traction in the past year on social networks for conspiracy theories that blame Jews for illegal immigration, media manipulation or financial misdeeds.
