California Secures $6M Settlement with Former 23andMe Over 2023 Genetic Data Breach Impacting Millions

California Attorney General Rob Bonta has reached a $6 million settlement with Chrome Holding Co., the company formerly known as 23andMe, regarding a 2023 data breach that impacted nearly 7 million customers across the country. Among those affected, more than 855,000 were California residents, as stated by the attorney general’s office. The settlement agreement was submitted on October 19 to the U.S. Bankruptcy Court for the Eastern District of Missouri and is currently awaiting judicial approval.

For former customers, this settlement does not reverse the exposure caused by the breach three years prior. However, it serves as an important reminder that individuals can still remove their genetic information, request destruction of their saliva samples, and revoke their research consent regardless of which entity currently controls their data.

This case underscores how genetic data breaches differ significantly from typical financial fraud. While compromised credentials can be changed or payments canceled, DNA data remains immutable and contains sensitive information about family members who may never have consented to testing.

A Settlement That Still Needs a Judge

The joint stipulation filed in bankruptcy court addresses a state lawsuit claiming that 23andMe’s inadequate data security measures led to the breach and that the company provided misleading statements to both customers and the public. These remain allegations rather than court determinations. The state also presented a parallel claim within the bankruptcy proceedings.

The agreement also settles a second matter. In March 2025, 23andMe filed for bankruptcy and subsequently transferred assets—including customer genetic data and biological samples—to TTAM Research Institute, a nonprofit organization founded by the company’s co-founder and former CEO. California challenged this transfer under its Genetic Information Privacy Act, which mandates explicit, separate consent before genetic data or samples are sold or relocated. Both the bankruptcy court and a federal district court dismissed that objection, and the settlement concludes the state’s appeal.

“Companies cannot sidestep California’s consumer protection and privacy laws simply by seeking bankruptcy protection,” Bonta emphasized. Under the terms of the settlement, the attorney general retains discretion to allocate the funds toward consumer remedies directly connected to the 2023 breach and associated expenses, though direct compensation to individual customers is not guaranteed. No hearing date for final approval has been scheduled.

Genetic Data Does Not Expire Like a Password

The breach itself was not technically complex. According to findings by Britain’s privacy regulator, an unauthorized actor exploited passwords leaked from other platforms to gain access to user accounts between April and September 2023. Despite detecting the intrusion, the company did not publicly disclose the attack until October 2023. Following a regulatory investigation, the UK Information Commissioner’s Office imposed a fine of £2.31 million (approximately $3.1 million) in June 2025, as reported by *The Register*.

While relatively few accounts were accessed directly, the breach expanded rapidly through the optional DNA Relatives matching tool, which allowed the intruder to view profile details of additional users connected via familial matches. This secondary exposure amplified the scope of the breach exponentially.

The enduring impact lies in the nature of genetic information. Ancestry results, family trees, and health predisposition data can enhance the credibility of fraudulent communications for years afterward. Although federal law prohibits employers from using genetic information in hiring decisions and restricts how most health insurers utilize such data, it offers limited oversight over life, disability, and long-term care insurance policies. This gap highlights why personal control over genetic records is essential for families.

Those most vulnerable include users who reused passwords across multiple services, individuals who opted into DNA Relatives features, and relatives whose profiles became visible through matched connections. While California enforces robust genetic privacy protections under state law, data governance varies widely in other jurisdictions.

Steps Former Customers Can Take Now

The attorney general’s office provided clear instructions for removing personal data from remaining accounts. Users can log in, navigate to Settings, locate the 23andMe Data section, and click View. Anyone wishing to retain a copy of their information should download it before choosing Permanently Delete Data and confirming deletion through a verification email.

Additional settings require attention. Customers who previously agreed to store their biological samples can modify that preference under Preferences, while those who consented to research participation can withdraw their consent via the Research and Product Consents menu.

Beyond managing account-specific data, households should audit any shared passwords across other online services, enable multi-factor authentication wherever available, and exercise caution when responding to unsolicited messages referencing ancestry or family relationships. Victims of suspected identity theft or fraud should file reports and establish recovery plans through IdentityTheft.gov. Hiring third-party firms to delete DNA records is unnecessary, since official deletion processes are handled directly through company account settings at no charge.

Final approval of the settlement now depends on the bankruptcy court’s review. With the breach irreversible, the most actionable step former customers can take today is determining whether their genetic information should continue to exist digitally.

Key Questions Answered

What did California announce? A $6 million settlement with Chrome Holding Co., formerly 23andMe, resolving claims related to the 2023 breach and the subsequent sale of customer genetic data during bankruptcy proceedings.

Is the settlement final? No. It was filed in the U.S. Bankruptcy Court for the Eastern District of Missouri and awaits court approval.

How many people were affected? Nearly 7 million customers nationwide, including over 855,000 Californians, according to the attorney general’s office.

Will customers receive money? The settlement permits the attorney general to direct funds toward consumer relief associated with the breach, but individual payouts aren’t assured.

Can I still delete my 23andMe data? Yes. Customers can delete their data, modify sample storage preferences, and withdraw research consent through account settings.

Why is a genetic data breach different? Genetic information cannot be reset like a password and reveals details about relatives, making exposure potentially harmful for extended periods.

Source link