California Attorney General Rob Bonta announced Thursday a lawsuit against 23andMe, formerly a prominent genetic testing company, alleging it failed to adequately protect customer data following a significant data breach in 2023. The breach exposed sensitive personal and genetic information belonging to nearly 7 million individuals nationwide, including over 850,000 Californians.
The exposed data included raw genetic information and health reports, which hackers subsequently offered for sale on the dark web in 2023. According to the Attorney General's office, the investigation revealed that hackers had unauthorized access to 23andMe's systems for five months undetected. The company reportedly initiated its investigation only after the compromised data appeared for sale online. Hackers exploited a common vulnerability known as credential stuffing, which leverages weak or reused passwords.
The lawsuit, filed against Chrome Holding Co., a subsidiary of TTAM Research Institute and the entity under which 23andMe operated during its bankruptcy proceedings, accuses the company of misleading consumers and neglecting essential security measures. Attorney General Bonta stated, "23andMe collected genetic data about millions of people, failed to meet its obligation under California law to keep that information safe, and then lied to consumers about the severity of its 2023 data breach."
Founded in San Francisco in 2006, 23andMe popularized at-home DNA testing. However, the company faced financial difficulties, filing for bankruptcy in March 2025, and was subsequently acquired by the nonprofit TTAM Research Institute, led by former CEO Anne Wojcicki. At the time of its bankruptcy filing, 23andMe had amassed approximately 15 million DNA samples. The Attorney General is also pursuing a separate legal action in bankruptcy court concerning the sale of Californians' genetic data during the bankruptcy process.
