MyHeritage

Is MyHeritage safe?

MyHeritage writes some of the strictest rules for DNA data in the industry, but its security record is weak. In June 2018 a researcher found a file holding the email addresses and hashed passwords of 92.3 million users on a server outside the company. No DNA data was in it, yet the leak led to a class action settlement in Israel, and California's attorney general later named it as one source of the passwords used in the 2023 23andMe attack. We score MyHeritage 63/100, below Ancestry at 69.

What happened in the 2018 breach

MyHeritage's security chief heard about the file on 4 June 2018. It covered every account created up to 26 October 2017. The company said the passwords were hashed, not stored in plain text, and that family trees and DNA data were kept on separate systems. Within days it expired all passwords and released two-factorTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary login by text message, which had been planned for later that summer.

In 2023 the Tel Aviv District Court approved a class action settlement of 400,000 ILS, plus free access to the Deep Nostalgia photo feature valued at about 1.09 million ILS. According to Pearl Cohen's summary of the ruling, a court-appointed expert found that MyHeritage was hit by a sophisticated attack and only added some of the industry's usual security controls afterwards. About 750,000 Israelis were affected. The court also rejected the company's argument that email addresses do not count as protected information.

The leak is now more than eight years old, but it is inside our 10-year window, so it still weighs on the security score. Two-factor login remains optional, and we found no public bug bounty on HackerOne or Bugcrowd.

How MyHeritage handles your DNA

The privacy policy, updated in June 2026, is firm on the points that matter most. Genetic and health information will never be sold or licensed to drug companies, government agencies or other firms without your explicit consent, and never to insurers or employers. MyHeritage prohibits police use of its DNA services and releases data only under a valid court order or subpoena. Research use requires a separate opt-in, either the DNA Informed Consent or an Individual Data Sharing Consent. The policy also says personal data, family trees included, has never been sold or licensed.

Two details are worth knowing. DNA samples are stored at a lab in the United States and may be kept for up to 10 years, though new tests on them need your prior approval. And the company has stopped accepting DNA uploads from other testing firms. DNA services are not offered in some countries, including Israel and Russia.

The company has been owned by the private equity firm Francisco Partners since April 2021, when it had about 85 million users. Founder Gilad Japhet stayed on as chief executive at the time of the sale. A change of owner does not change the policy on its own, but it is worth knowing who holds the data.

What the app collects

Apple's privacy label lists contact details, purchases, photos, audio, search history and identifiers as linked to you, used for analytics, personalisation and MyHeritage's own marketing, with nothing used to track you across other companies' apps. Google Play is less tidy: it says crash logs, app interactions and in-app search history are shared with other companies for analytics. The website ignores Do Not Track browser signals.

AI features add more processors. The policy says AI Record Finder and AI Biographer send what you type, or tree details, to OpenAI, Scribe AI documents go to Google, and animated photo features use outside AI providers. Photo tools such as Deep Nostalgia, In Color, Photo Enhancer and AI Time Machine process "Image Data" from the photos you upload; the policy says they collect no biometric identifiers, and photos used in AI Time Machine are not kept or used for training. You can simply not use AI Biographer, Scribe AI and the other AI features.

Data is kept "only for as long as necessary", with one catch: MyHeritage may keep your contact details after a subscription ends to market to you, citing its legitimate interest.

How to use MyHeritage more safely

1. Turn on two-factorTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary login and choose a password you have never used elsewhere, especially if you had an account before 2018.
2. Decide whether you want DNA Matching on. Matches can reveal unknown relatives, and each match sees how much DNA you share.
3. Ask before adding living relatives or their photos to a tree; the policy requires their consent.
4. If you stop using the service, delete your DNA results, then ask MyHeritage ([email protected]) to destroy your sample.

For a calorie-tracking app with a similar breach history, see MyFitnessPal.

How we scored it

Regulatory record (85) is MyHeritage's best factor: no regulator has fined it, and the Israeli settlement counts as a lawsuit. Transparency and control (70) and scams and harmful content (70) are solid, with self-service DNA deletion and consent rules for living relatives. Security (48) is the weakest, because the 2018 leak exposed 92.3 million logins and two-factorTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary login is still optional.