Genetics Testing Firm’s Settlement Marks Latest Legal Resolution from 2023 Data Breach
In a significant legal development, the genetics testing company 23andMe, officially known as Chrome Holdings, has reached an agreement to settle litigation initiated by the California Department of Justice. This settlement, amounting to $6 million, directly relates to a cyberattack that, in 2023, compromised the personal data of nearly 7 million consumers, impacting approximately 855,000 residents in California.
The proposed settlement was submitted to the U.S. Bankruptcy Court in the Eastern District of Missouri on Monday, pending judicial approval. This agreement addresses the legal action filed in May 2026 by California against 23andMe. The lawsuit accused the genetic testing firm of violating several California consumer protection and privacy laws by failing to adequately safeguard sensitive customer information and genetic data. This failure ultimately led to a significant data breach, which has attracted widespread attention and criticism.
Included in the terms of this proposed settlement is the provision that consumers affected by the hack maintain the ability to request the deletion of their personal information as well as the destruction of their saliva samples. This aspect of the settlement underscores the continuing emphasis on data privacy and consumer rights in the aftermath of such breaches.
Moreover, the settlement also seeks to resolve a prior appeal made by California Attorney General Rob Bonta. This appeal emerged following the court’s rejection of Bonta’s objection based on state law regarding the sale of Californians’ genetic data and samples amid the company’s bankruptcy proceedings. The Attorney General emphasized the necessity for consumer consent in decisions about their genetic information, particularly in situations as sensitive as these.
23andMe, which was established in San Francisco, filed for bankruptcy in March 2025. The path leading to this difficult juncture involved a variety of operational challenges, culminating in its bankruptcy filing. Following this, in July 2025, a federal bankruptcy court approved the acquisition of 23andMe’s operational assets by TTAM Research Institute, a new entity founded by 23andMe’s co-founder and former CEO, Anne Wojcicki. This acquisition was seen as a pathway for the continuation of the business while attempting to manage the accumulated debts and liabilities still held by Chrome Holdings.
The proposed agreement with California represents yet another settlement in a series of legal challenges that 23andMe has faced in the wake of the significant data breach. Earlier, in June, the Missouri bankruptcy court approved a substantial settlement of $46.75 million aimed at compensating victims of the credential-stuffing attack that initially exposed their data. Additionally, in July, Chrome Holdings consented to pay $18 million to resolve allegations brought forth by 43 other state attorneys general, which centered on security lapses tied to the same breach.
Internationally, the repercussions of the data breach extended beyond U.S. borders. In June 2025, the Information Commissioner’s Office in the United Kingdom imposed a fine of approximately £2.31 million (around $3.1 million) against 23andMe, citing the firm for "serious" privacy violations associated with the leak of personal data. Such actions highlight the growing scrutiny that companies face regarding their data protection practices and the imperative for robust security measures in handling sensitive information.
The original cyberattack that precipitated these settlements was reported by 23andMe in October 2023. The attack, attributed to credential stuffing tactics, initially compromised about 14,000 customer accounts. Attackers leveraged reused passwords to gain unauthorized access, subsequently utilizing 23andMe’s DNA Relatives feature to retrieve personal data linked to approximately 6.9 million users. This incident raised alarms regarding the vulnerabilities inherent in genetic testing services and the potential risks associated with sharing such intimate personal information with third-party companies.
As the legal proceedings evolve, the emphasis remains on bolstering data security and ensuring consumers’ rights are protected in an increasingly digitized world. The implications of these settlements extend beyond financial penalties; they serve as a wake-up call for companies to reevaluate their data strategies and prioritize the safeguarding of consumer information against future threats. The unfolding narrative surrounding 23andMe is a crucial chapter in the ongoing discourse on data privacy and security in the modern landscape.