Executives at 23andMe learned about the company's April 2023 data breach after someone tried to sell a sample of the hacked data on Reddit, according to an enforcement decision connected with a €2.4 million ($2.7 million) fine levied by a Spanish data privacy regulator. The Agencia Española de Protección de Datos (AEPD) announced the fine on Friday, saying in its decision that more than 2,600 Spaniards were impacted by a breach affecting 6.9 million people worldwide. 23andMe didn’t notify Spanish officials about the hack until 12 days after the firm learned of it, according to the decision, which called the need for immediate notification “not trivial” due to the importance of early mitigation. The firm also did not place limits on accessing, requesting or downloading data per IP address, the decision said. The cybersecurity failings are particularly striking because 23andMe cited ransomware and other cyber threats at length in a May 2023 fiscal report the regulator found on the firm’s website.