California AG Sues 23andMe Over 2023 Data Theft

California Attorney General Rob Bonta initiated a lawsuit against Chrome Holding Co., the company formerly known as 23andMe, due to a significant data breach in 2023. Millions of users' sensitive personal and genetic data were compromised, affecting approximately 7 million individuals globally, with 855,541 residing in California.

Bonta alleges that 23andMe failed to adequately protect users' genetic information, which included details about health, relatives, and ancestry. The company acknowledged that attackers gained access through credential stuffing, utilizing credentials stolen from other breaches, such as one at MyHeritage. Despite awareness of prior breaches, 23andMe allegedly did not prevent users from reusing compromised credentials.

The lawsuit further details that hackers exploited a vulnerability in the DNA Relatives feature after initially breaching 14,000 accounts. California's Attorney General contends that the company's security was so inadequate that unauthorized access persisted for five months. Investigations reportedly began only after data was already being sold on the dark web and ransom demands were made.

23andMe is also accused of omitting critical details when notifying customers about the breach, downplaying the sensitivity of the stolen data. The company allegedly described the DNA Relatives feature as "essentially public" while simultaneously negotiating with hackers who were specifically highlighting data pertaining to Asian American, Pacific Islander, and Jewish users.

The incident occurred during a period of rising anti-Asian and antisemitic sentiment, making the exposure of this specific data particularly alarming. 23andMe subsequently filed for bankruptcy in March 2025 and a judge approved a $50 million settlement related to a class-action lawsuit concerning the failure to protect customer data.