23andMe Sued Over Massive 2023 Data Breach

In May 2026, California Attorney General Rob Bonta filed a lawsuit against 23andMe, the genetics testing company, alleging mishandling of a major data breach that began in April 2023. This breach exposed the genetic and personal information of an estimated 6.9 million U.S. customers over a five-month period.

The complaint, lodged in San Francisco Superior Court, asserts that 23andMe ignored numerous warnings about system compromises and subsequently downplayed the breach's severity. The exposed data included sensitive details about customers' health predispositions, biological relatives, ancestry, and ethnicity.

Approximately 856,000 Californians were impacted by this incident. Attorney General Bonta stated the company's actions were "entirely unacceptable" and is seeking significant civil fines, potentially totaling millions of dollars, for violations of California's Genetic Information Privacy Act and consumer protection statutes.

The lawsuit follows an earlier development, occurring 14 months after 23andMe filed for bankruptcy. In March 2026, a federal judge approved a $30 million to $50 million fund to resolve most U.S. customer claims stemming from the breach. This settlement also addressed claims that the company failed to inform customers of specific ethnic backgrounds that were targeted.

23andMe, founded in 2006 and based in Palo Alto, California, filed for Chapter 11 bankruptcy protection in March 2025, citing the data breach, litigation, increased competition, and declining demand. Previously, in July 2025, a nonprofit controlled by 23andMe co-founder Anne Wojcicki acquired the company's assets for $305 million, a sale that California had opposed on privacy grounds, with that challenge still pending.