California has secured a $6 million settlement from the company formerly known as 23andMe over the massive 2023 data breach that exposed genetic and personal information belonging to millions of customers.
The agreement resolves claims brought by California Attorney General Rob Bonta against Chrome Holding Co., the successor to the bankrupt DNA-testing company.
The breach affected nearly 7 million people nationwide, including more than 855,000 Californians.
The settlement also ends California’s legal challenge to the transfer of customers’ genetic data during the company’s bankruptcy sale.
FCRF’s Chief AI Officer Certification Returns on November 14 to Prepare Future AI Leaders
Breach Exposed Genetic and Personal Data
The 2023 intrusion became one of the most serious privacy incidents involving a consumer genetics company.
Attackers initially gained access using compromised usernames and passwords belonging to some customers.
They then used a feature that allowed users to connect with genetic relatives to access information linked to millions of additional profiles.
The exposed data included names, ancestry information, genetic relationships and other personal details.
For some users, information related to health risks and genetic characteristics was also potentially affected.
California later accused 23andMe of failing to maintain reasonable security protections despite holding highly sensitive biological and genetic information.
The state also alleged that the company did not adequately respond to warnings that its systems had been compromised.
California Tried to Block Genetic Data Transfer
The privacy dispute became more complicated after 23andMe filed for bankruptcy in March 2025.
The company eventually agreed to sell its assets for $305 million to TTAM Research Institute, a nonprofit controlled by 23andMe co-founder Anne Wojcicki.
California objected to that sale.
The state argued that customers’ genetic information and biological samples should not be transferred to a new owner without separate and explicit consent.
Attorney General Bonta relied on California’s Genetic Information Privacy Act, which provides special protections for genetic data.
However, both the bankruptcy court and district court rejected California’s attempt to block the transfer.
The state then appealed.
The new $6 million settlement resolves that appeal as well as California’s separate legal claims connected to the breach.
Customers Still Have Right to Delete Their Data
An important part of the settlement is what it does not change.
California consumers retain the right to ask the company to delete their personal and genetic information.
They can also request destruction of biological samples held by the company.
That right continues even though 23andMe’s ownership has changed.
Bonta said consumers should remain aware that genetic information is especially sensitive because it cannot be changed like a password or bank account number.
Once genetic data is exposed, the privacy risk can remain for decades.
It may also reveal information not just about one person but about biological relatives who never directly used the service.
That makes breaches involving DNA databases particularly serious.
Settlement Is Only One Part of 23andMe’s Legal Fallout
The $6 million California settlement is separate from other payments connected to the breach.
Chrome Holding previously agreed to pay $18 million to 42 states in July.
The company also agreed to distribute about $46.75 million under a separate settlement for consumers affected by the breach.
Those payments reflect the scale of legal action that followed the incident.
23andMe’s financial problems worsened after the breach as the company faced litigation, regulatory scrutiny and declining demand for its DNA-testing products.
It filed for Chapter 11 bankruptcy in 2025.
The company’s collapse raised a broader privacy question: what happens to highly sensitive genetic data when the business holding it fails?
Unlike ordinary customer records, genetic information can remain useful and sensitive for a lifetime.
That has pushed regulators to treat bankruptcy transfers involving DNA databases differently from conventional corporate asset sales.
Genetic Data Becomes a Growing Regulatory Concern
The 23andMe case is likely to influence how regulators approach other companies storing biological or biometric information.
Genetic data has commercial value for health research, drug development and personalised medicine.
But that same value makes it especially sensitive.
Governments are increasingly asking whether traditional privacy laws are strong enough to protect information that cannot be reset or replaced.
California’s case shows that regulators may try to intervene not only when data is breached, but also when ownership of a sensitive database changes.
The settlement ends this particular dispute, but the broader question remains unresolved.
Companies collecting genetic information will face growing pressure to explain how that data is secured, transferred and eventually deleted.
What this means for you:
If you have used a genetic testing service, review its privacy and deletion options carefully. Genetic data can reveal permanent information about you and your relatives, making its protection more important than an ordinary password or account credential.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
