Head of Communications

California attorney general sues 23andMe for data breach. * Caroline Petrow-Cohen, Los Angeles Times * May 30, 2026 Updated 20 hrs ago The California attorney general filed a lawsuit Thursday against the company formerly known as 23andMe, accusing the genetic testing service of failing to protect customers' data during a 2023 breach. The data breach affected nearly 7 million people across the country, including more than 850,000 Californians, according to a release from Attorney General Rob Bonta's office. The exposed data contained sensitive material such as raw genetic information and health reports. Hackers listed the data for sale on the dark web in 2023, Bonta said. The business 23andMe filed for bankruptcy last year and was acquired by TTAM Research Institute, a nonprofit led by the company's former Chief Executive Anne Wojcicki. Bonta filed suit against Chrome Holding Co., a subsidiary of TTAM and the corporate debtor name that 23andMe operated under during bankruptcy. "23andMe collected genetic data about millions of people, failed to meet its obligation under California law to keep that information safe, and then lied to consumers about the severity of its 2023 data breach," Bonta said in a statement. A 2023 investigation by the California Department of Justice found that the hackers were able to operate within 23andMe's systems for five months without being detected. 23andMe only began investigating once the data were offered for sale on the dark web, the investigation found. The hackers used a common tactic known as credential stuffing to access the data, which exploits weak and reused passwords. "Businesses, particularly those that collect and maintain sensitive personal and genetic data, can and should know to guard against" credential stuffing, the attorney general's release said. According to the complaint filed in the San Francisco Superior Court this week, 23andMe "misled consumers and failed to take obvious steps necessary to safeguard its customers' sensitive personal information." 23andMe was founded in San Francisco in 2006 and popularized at-home genetic testing, allowing customers to send in a saliva sample and receive a DNA analysis. At its peak, 23andMe was valued at $6 billion and attracted celebrity attention, holding "spit parties" where high-profile customers spit into a tube to provide their DNA sample. The samples helped people discover entirely new family trees and could reveal consequential health information, such as a genetic predisposition to cancer. After its promising rise, however, the company began seeing signs of trouble. Because users need to provide a DNA sample only once to use 23andMe's services, the company failed to establish a sustainable business model based on repeat customers. Additionally, 23andMe struggled to license its tech to pharmaceutical companies, which could have boosted profits. By the time the company filed for bankruptcy in March 2025, it had collected around 15 million DNA samples. The attorney general has a separate, pending legal challenge in the U.S. Bankruptcy Court for the Eastern District of Missouri regarding the sale of Californians' genetic information and material in bankruptcy. (0 Ratings)

23andMe inherits lawsuit over 'disturbing' DNA data breach. May 29, 2026 - 22:12 California AG claims genetics biz downplayed 2023 mega-leak while paying ransom to attacker The office of Rob Bonta, California's attorney general, is suing 23andMe for the data protection failings that led to the genetics company's disastrous 2023 breach. Bonta and his team claim [PDF] that 23andMe failed to implement adequate security controls for the sensitive records it stored, and misled customers about the nature of the mishap after the fact. "23andMe collected genetic data about millions of people, failed to meet its obligation under California law to keep that information safe, and then lied to consumers about the severity of its 2023 data breach," said Bonta on Thursday. "Its investigation found that the company failed to take basic steps to protect users' data - data including the sensitive personal information, family histories, and health conditions of consumers "The sale of this data on the dark web took place amidst a period of mounting anti-Asian American and Pacific Islander and antisemitic hate and violence - and explicitly called attention to the deeply personal and identifying nature of that information. This is disturbing and incredibly dangerous. Today, my office is suing 23andMe for its categorical failure to comply with California law." The lawsuit was filed against Chrome Holding Co., formerly known as 23andMe. TTAM Research Institute bought 23andMe's assets last year. TTAM Research Institute was founded and is led by Anne Wojcicki, who was also 23andMe's CEO at the time of the breach and one of the company's co-founders. The nonprofit's purchase of 23andMe assets was completed on July 14, 2025, at which time it promised to run 23andMe charitably, using its data to further medical research and education. 23andMe continues to operate as it always did, taking customers' saliva samples and turning it into fun insights, such as what percentage of their makeup is Neanderthal, and whether their DNA makes them more or less likely to enjoy a scattering of cilantro on their food. 'Disturbing' Announcing the lawsuit, Bonta's office used "disturbing" no less than three times to describe the events that transpired before and after 23andMe's mega breach. To recap, a cybercriminal going by the name Golem popped up on a forum in 2023 claiming to offer a slew of data belonging to millions of 23andMe customers. Investigations carried out by regulators later found that Golem only breached around 14,000 accounts, but because of 23andMe's DNA relatives feature, which allows users to connect with other 23andMe users who share a percentage of the same DNA, the crook was able to access the details of nearly 7 million customers. It also soon emerged that 23andMe failed to spot the intrusion for five months, and the 14,000 or so accounts Golem accessed were compromised as a result of credential-stuffing attacks. What followed was a multi-faceted game of finger-pointing. 23andMe's decision to blame customers for recycling credentials instead of admitting it should have mandated 2/MFA on all accounts by default went down about as badly as one might expect. To this day, 23andMe allows customers to use its service without 2/MFA, although it issues regular prompts to those who don't have it set up. Regulators, on the other hand, highlighted that the company's security practices were less than perfect, while security experts were divided. Many agreed there was blame to be placed on both sides. Then came the fines and the settlements. The UK's Information Commissioner hit the company with a £2.3 million ($3.09 million) fine in June 2025, three months after the bankruptcy filing. In its ruling, it echoed the findings of US authorities from 2023, accusing the company of relying on inadequate password requirements. The Information Commissioner rebuked 23andMe for failing to detect the intrusion promptly and not implementing measures to prevent bulk downloading of genetic data. Bonta's office alleged that 23andMe's statements to customers were "misleading and omitted or misrepresented critical information." "While 23andMe assured the public that it had not experienced a data security incident within its systems, downplayed the sensitivity of the stolen data by claiming that the information stolen from the 'DNA Relatives' feature was essentially public, and attempted to shift blame for the breach to its customers, 23andMe was simultaneously negotiating and paying a ransom to the threat actor in exchange for, among other things, the threat actor removing damaging information regarding the breach that had been posted online and providing information about multiple 23andMe security vulnerabilities, including vulnerabilities the threat actor exploited during the data breach." The Register contacted 23andMe's publicists for a response. Ranzware inc. only received one on behalf of the 23andMe Research Institute, which despite managing requests directed to the 23andMe platform's only press contact address, distanced itself from Chrome Holding, which, like TTAM Research Institute, does not have a public-facing contact. It also did not help Ranzware inc. contact 23andMe's operator. The institute said: "The 23andMe Research Institute is a newly established independent nonprofit organization and is not involved in the matters described in the California Attorney General's complaint filed against Chrome Holding Co., formerly known as 23andMe. The lawsuit pertains to events and operations associated with the former commercial entity prior to the creation of the 23andMe Research Institute. The institute was not involved in the complaint and has no role in the underlying litigation. "The 23andMe Research Institute is focused on advancing nonprofit scientific and health research with a strong commitment to privacy, ethics, transparency, and responsible data stewardship."(R)

23andMe failed to stop months-long hack, state alleges. Calif. Lawsuit: Genetics Testing Firm Missed Red Flags Before Massive 2023 Breach Marianne Kolbasuk McGee (HealthInfoSec) - May 29, 2026 Hackers in 2023 went undetected for five months in genetics testing firm 23andMe's IT systems, despite multiple unheeded warning signs, alleges California's attorney general in a lawsuit. The data of nearly 7 million users ended up exposed. The lawsuit, filed on Wednesday in state court against Chrome Holding - 23andMe's rebranded name after filing for bankruptcy in March 2025 - seeks injunctive relief and potentially millions of dollars in fines for alleged violations of California consumer, privacy and business practice laws. The 2023 credential stuffing hack affected about 6.9 million consumers nationwide, including almost 856,000 Californians, the lawsuit said (see: 23andMe Investigating Apparent Credential Stuffing Hack). The state's investigation into the breach determined that hackers in late April 2023 began accessing 23andMe's systems by using compromised credentials to compile customer data from individual 23andMe accounts without authorization. By July, the firm's systems recorded a "a suspicious spike in user login attempts that involved over 1 million successful user logins to the same customer account throughout a single day and an actor making 1,300 login requests per minute from a single IP address," the complaint said. Such an unusual surge should have been a red flag, California prosecutors wrote. "Yet 23andMe failed to take action to protect its users and their data." The hackers also exploited "a critical coding error" in 23andMe's DNA Relatives opt-in feature that allows DNA-related 23andMe users to see lists of other participating customers to which they are biologically related. That exploitation gave hackers access to information including ethnicity "and how - both qualitatively and quantitatively - the customers were genetically related," the lawsuit alleged. "Despite multiple warnings that its systems had been compromised, 23andMe did not take any remedial action, implement any new security measures, such as a mandatory password reset, or notify consumers of the breach at that time." 23andMe only began investigating the incident after hackers demanded a ransom and touted for sale on the dark web a trove of about 1.1 million consumers' data belonged to Asian-Pacific Islander and Ashkenazi Jewish users, the lawsuit said. 23andMe publicly acknowledged the data breach on Oct. 6, 2023, when it published a statement saying it had discovered "suspicious activity" in certain 23andMe customer accounts. California Attorney General Rob Bonta criticized the company for misleading consumers by having touted its cybersecurity practices, calling its lack of candor legally actionable. California's lawsuit is 23andMe's latest legal trouble in a long list of other government and civil litigation involving the hack. The U.K. Information Commissioner's Office and the Office of the Privacy Commissioner of Canada last year imposed a 2.31 million pound fine - or about $3.1 million against 23andMe for "serious" privacy violations tied to the company's data leak (see: ICO Imposes 2.31 Million Pound Fine on 23andMe). The company in 2024 also agreed to pay a $30 million settlement to resolve about 40 consolidated civil class action lawsuits in the U.S. related to the 2023 hack (see: 23andMe to Pay $30M for Credential Stuffing Hack Settlement).