Genetic data is the kind of information you cannot replace the way you replace a password. That is why the 2023 23andMe breach keeps having consequences: the company that succeeded it agreed to pay California $6 million for failing to protect customers’ data properly.
The settlement
According to The Record, Chrome Holding Company, the current name of the former 23andMe, will pay the state, as announced by Attorney General Rob Bonta. The accusation is that the company did not adequately protect personal and genetic data, which enabled the 2023 attack that exposed information of nearly 7 million people.
The deal still needs approval from the US Bankruptcy Court for the Eastern District of Missouri. Affected consumers keep the right to delete their data and to have their genetic samples destroyed. Bonta said, “Companies cannot evade California’s consumer protection and privacy laws by filing for bankruptcy.”
How the story got here
In March 2025, 23andMe filed for bankruptcy and sold customers’ saliva samples and genetic data to TTAM Research Institute, a nonprofit created by former CEO Anne Wojcicki. Wojcicki is also CEO of Chrome Holding Company. TTAM says it had no role in the settlement. In July, the company had already settled for $18 million with 42 other state attorneys general.
Why it matters beyond the US
The report covers an American case and does not say how many people elsewhere were affected. Even so, the lesson travels. Anywhere you have sent saliva to an ancestry or health service, it is worth knowing what it keeps and who it shares it with, including what happens if the company is sold or goes bankrupt.
How to protect yourself
- Ask for deletion of your data from any DNA service you no longer use, and for destruction of the sample if that option exists.
- Read what happens in a sale or bankruptcy. The data can move to a new owner, as it did here.
- Think twice before sending genetic material. Unlike a password, it cannot be changed.
- Protect the account with a unique password and two-step verification.
- Be suspicious of emails about the case. Scammers use known breaches to ask for data and charge fake fees.
