23andMe Successor Settles with California for $6 Million Over Data Breach Failings

A holding company formerly known as 23andMe has agreed to pay California $6 million to resolve allegations that it did not effectively shield customers’ personal and genetic data, enabling a massive 2023 breach that exposed sensitive information belonging to nearly 7 million people. The settlement, pending approval by the U.S. Bankruptcy Court in the Eastern District of Missouri, also ensures that affected consumers retain the right to delete their data and order the destruction of their genetic samples.

This legal action stems from a significant data breach that occurred in 2023, which compromised the sensitive genetic and personal information of millions of 23andMe customers. California Attorney General Rob Bonta stated that companies cannot evade consumer protection and privacy laws by filing for bankruptcy, underscoring the regulatory scrutiny following such security incidents.

In March 2025, 23andMe filed for bankruptcy and subsequently sold customer saliva samples and genetic data to the TTAM Research Institute, a nonprofit established by 23andMe’s former founder and CEO, Anne Wojcicki. Wojcicki also serves as the CEO of the Chrome Holding Company, the entity that reached the settlement with the state of California.

23andMe, once a prominent player in the genetic testing industry, faced declining fortunes as the market for such services contracted. The data breach is widely considered to have delivered the final blow to the company's operations. "23andMe collected genetic data about millions of people and failed to meet its obligation to keep that information safe," Bonta commented.

This settlement with California follows a previous agreement in July, where 23andMe settled with a coalition of 42 additional state attorneys general for $18 million. These collective actions highlight a pattern of regulatory and legal consequences for companies that fail to adequately secure sensitive personal data.

The terms of the settlement aim to provide some recourse for affected individuals, particularly concerning the deletion of their data and the destruction of genetic samples. The bankruptcy filing and subsequent sale of data to TTAM Research Institute add a layer of complexity to the aftermath of the breach.

While Chrome Holding Company, the settling entity, has no authorized spokespeople for the press, the settlement signifies a move towards resolving the legal ramifications of the breach. The TTAM Research Institute did not immediately respond to requests for comment.

The case serves as a stark reminder of the critical importance of robust cybersecurity measures, especially for companies handling highly sensitive personal and genetic information. The financial penalties and ongoing legal scrutiny underscore the significant risks and liabilities associated with data protection failures.