AG Sues 23andMe for Failing to Protect Genetic Data

California Attorney General Rob Bonta initiated legal action against Chrome Holding Co., formerly 23andMe, on Thursday. The lawsuit addresses a significant 2023 data breach that compromised the personal and genetic information of almost 7 million individuals. The company is accused of inadequate response and investigation despite multiple alerts about its compromised systems.

The breach, occurring in 2023, exploited a "credential-stuffing attack" by cybercriminals. Over several months, intruders accessed sensitive data, including ancestry and genetic details. Notably, the threat actor operated within 23andMe's systems undetected for more than five months before the company began its investigation, which was reportedly prompted by the stolen data being offered for sale and a ransom demand.

The San Francisco-based company confirmed the breach in October 2023, specifying that customers of Chinese or Ashkenazi Jewish ancestry were particularly targeted. Over a million users' data from these groups was subsequently listed for sale on the dark web, a development that occurred during a period of increased anti-Asian and antisemitic hate crimes.

This legal action follows a previous lawsuit filed in January 2024, which also accused the company of insufficient customer protection and failure to notify targeted individuals. That lawsuit was later settled for $30 million. 23andMe, once a leader in consumer DNA testing, filed for bankruptcy in 2025. Its assets were acquired for $305 million last July by TTAM Research Institute, a nonprofit led by cofounder and former CEO Anne Wojcicki.