California Attorney General Rob Bonta announced plans to sue Chrome Holding, alleging the company’s predecessor, 23andMe, failed to protect customer genetic data in a 2023 breach that exposed sensitive information for nearly seven million users. Bonta said his probe found 23andMe did not take basic protections and misled consumers about the breach’s severity, and that stolen data later appeared for sale on the dark web with references to Asian American Pacific Islander and Jewish users.
Alleged Breach And Scope
Bonta said the 2023 incident exposed genetic predispositions and risk factors, ancestry details, ethnicity, and information about biological relatives for almost seven million accounts. The Attorney General’s office alleges attackers used credential stuffing—recycling passwords from prior breaches—to access accounts where users had reused login credentials.
Claims About Company Conduct
The California probe concluded that 23andMe failed to implement basic security steps and “lied to consumers” about how severe the breach was, Bonta said. The AG also flagged that threat actors marketed stolen records on the dark web by highlighting the data belonged to AAPI and Jewish users.
Regulatory Actions And Fines
UK authorities previously fined 23andMe £2.31 million after an Information Commissioner’s Office investigation found inadequate protections and failures in authentication that exposed personal data of 155,592 UK residents. That ICO probe was coordinated with Canada’s privacy commissioner.
Bankruptcy, Rebrand, And Company Response
23andMe filed for Chapter 11 in 2025 and later rebranded as Chrome Holding; the company has said it has made binding commitments to improve customer privacy and security.
User Concerns And Account Access
Following the bankruptcy filing, some users reported difficulty deleting accounts and expressed concern that data might be sold to buyers, including insurers, during the court-supervised sale process. The AG’s filing and prior regulator findings center on the sensitivity of genetic data and the need for strict authentication and verification protections.
Background On 23andMe
23andMe was co-founded by Anne Wojcicki and once attracted high-profile customers and a peak market valuation before the company’s financial decline and rebrand. The Attorney General’s civil action aims to hold the company accountable under California consumer protection and data‑security laws.
Featured image credits: Wikimedia Commons
For more stories like it, click the +Follow button at the top of this page to follow us.