UNITED STATES
SECURITIES AND EXCHANGE COMMISSION
Washington, D.C. 20549
FORM
CURRENT REPORT
Pursuant to Section 13 15(d)
of the Securities Exchange Act of 1934
Date of Report (Date of earliest event reported):
(Exact name of registrant as specified in its charter)
| (State or other jurisdiction of incorporation) |
(Commission File Number) |
(IRS Employer Identification No.) |
(Address of principal executive offices, including zip code)
Registrant’s telephone number, including area code:
Check the appropriate box below if the Form 8-K filing is intended to simultaneously satisfy the filing obligation of the registrant under any of the following provisions:
| Written communications pursuant to Rule 425 under the Securities Act (17 CFR 230.425) |
| Soliciting material pursuant to Rule 14a-12 under the Exchange Act (17 CFR 240.14a-12) |
| Pre-commencement communications pursuant to Rule 14d-2(b) under the Exchange Act (17 CFR 240.14d-2(b)) |
| Pre-commencement communications pursuant to Rule 13e-4(c) under the Exchange Act (17 CFR 240.13e-4(c)) |
Securities registered pursuant to Section 12(b) of the Act:
| Title of each class |
Trading Symbol(s) |
Name of each exchange on which registered | ||
Indicate by check mark whether the registrant is an emerging growth company as defined in Rule 405 of the Securities Act of 1933 (§230.405 of this chapter) or Rule 12b-2 of the Securities Exchange Act of 1934 (§240.12b-2 of this chapter).
Emerging growth company
If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐
| Item 7.01 | Regulation FD Disclosure |
23andMe Holding Co. (“23andMe,” “we,” “us,” and “our”) recently learned that certain profile information, which a customer creates and chooses to share with their genetic relatives in the DNA Relatives feature, was accessed from individual 23andMe.com accounts without the account users’ authorization (the “incident”). Based on 23andMe’s investigation as of the date of this Current Report on Form 8-K, we do not have any indication at this time that there has been a data security incident within our systems, or that 23andMe was the source of the account credentials used in these attacks. While our investigation is ongoing, as of the date of this Current Report on Form 8-K, we believe the threat actor was able to access certain accounts in instances usernames and passwords that were used on 23andMe.com were the same as those used on other websites that had been previously compromised or otherwise available. 23andMe undertook immediate action in accordance with its incident response plan, including taking affirmative security measures to mitigate any potential impact of the incident, working to validate whether data that was accessed was legitimate data from the Website, and determining the full scope of data accessed by unauthorized individuals.
23andMe has retained third-party forensic experts to assist in an investigation of the cause and scope of the incident, and in mitigating and remediating the impact of the incident. 23andMe is fully cooperating with federal law enforcement in relation to this incident. 23andMe is currently working to confirm the scope of data accessed, and is investigating the nature of the personal data in question and any related legal obligations.
23andMe’s investigation into these matters is preliminary and on going, and 23andMe is still discerning the implications of the incident. During the course of the investigation, 23andMe may become aware of new or different information or information that differs from that contained in this Current Report on Form 8-K. At this time, 23andMe is unable to predict the costs and magnitude of those consequences.
Forward-Looking Statements
This Current Report on Form 8-K contains “forward-looking” statements, which are subject to the safe harbor provisions of the Private Securities Litigation Reform Act of 1995, including statements regarding 23andMe’s understanding of the cause of the incident, the scope of the incident, the persons or organizations that may be responsible for the incident, the status and results of the investigations to data, and the potential impact of the incident on 23andMe’s business operations and financial results and condition. These forward-looking statements are based on management’s beliefs and assumptions and on information currently available to management, which may change as investigations proceed and new or different information is discovered. Forward-looking statements include all statements that are not historical facts and may be identified by terms such as “aim,” “anticipate,” “believe,” “can,” “could,” “seek,” “should,” “feel,” “expect,” “will,” “would,” “plan,” “intend,” “estimate,” “continue,” “may,” or similar expressions and the negatives of those terms. Forward-looking statements involve known and unknown risks, uncertainties and other factors that may cause actual results, performance or achievements to be materially different from any future results, performance or achievements expressed or implied by the forward-looking statements. Factors that could cause or contribute to such differences include, but are not limited to the discovery of new or different information relating to the incident and its mitigation, numerous financial, legal, reputational and other risks to 23andMe related to the incident, including risks that the incident may result in the loss, compromise or corruption of data, loss of business, reputational damage adversely affecting customer relationships and investor confidence, U.S. regulatory investigations and enforcement actions, litigation, indemnity obligations, damages for contractual breach, penalties for violation of applicable laws or regulations, significant costs for remediation and the incurrence of other liabilities; and the possibility that 23andMe’s insurance coverage will cover only certain security and privacy damages and claim expenses may not be available or sufficient to compensate for any and all liabilities that 23andMe may incur related to the incident.
All information provided in this Current Report on Form 8-K is as of the date hereof and 23andMe’s undertakes no duty to update this information except as required by applicable law.
The information in this report furnished pursuant to Item 7.01 shall not be deemed to be “filed” for the purposes of Section 18 of the Securities Exchange Act of 1934, as amended, nor shall it be incorporated by reference in any filing made by the Company pursuant to the Securities Act of 1933, as amended, other than to the extent that such filing incorporates by reference any or all of such information by express reference thereto.
SIGNATURES
Pursuant to the requirements of the Securities Exchange Act of 1934, as amended, the registrant has duly caused this report to be signed on its behalf by the undersigned hereunto duly authorized.
| 23ANDME HOLDING CO. | ||
| By: | /s/ Kathy Hibbs | |
| Name: | Kathy Hibbs | |
| Title: | Chief Administrative Officer | |
Dated: October 10, 2023