The California attorney general filed a lawsuit Thursday against the company formerly known as 23andMe, accusing the genetic testing service of failing to protect customers’ data during a 2023 breach.
The data breach affected nearly 7 million people across the country, including more than 850,000 Californians, according to a release from Atty. Gen. Rob Bonta’s office.
The exposed data contained sensitive material such as raw genetic information and health reports. Hackers listed the data for sale on the dark web in 2023, Bonta said.
23andMe filed for bankruptcy last year and was acquired by TTAM Research Institute, a nonprofit led by the company’s former Chief Executive Anne Wojcicki. Bonta filed suit against Chrome Holding Co., a subsidiary of TTAM and the corporate debtor name that 23andMe operated under during bankruptcy.
“23andMe collected genetic data about millions of people, failed to meet its obligation under California law to keep that information safe, and then lied to consumers about the severity of its 2023 data breach,” Bonta said in a statement.
A 2023 investigation by the California Department of Justice found that the hackers were able to operate within 23andMe’s systems for five months without being detected. 23andMe only began investigating once the data were offered for sale on the dark web, the investigation found.
The hackers used a common tactic known as credential stuffing to access the data, which exploits weak and reused passwords.
“Businesses, particularly those that collect and maintain sensitive personal and genetic data, can and should know to guard against” credential stuffing, the attorney general’s release said.
According to the complaint filed in the San Francisco Superior Court this week, 23andMe “misled consumers and failed to take obvious steps necessary to safeguard its customers’ sensitive personal information.”
23andMe was founded in San Francisco in 2006 and popularized at-home genetic testing, allowing customers to send in a saliva sample and receive a DNA analysis.
At its peak, 23andMe was valued at $6 billion and attracted celebrity attention, holding “spit parties” where high-profile customers spit into a tube to provide their DNA sample. The samples helped people discover entirely new family trees and could reveal consequential health information, such as a genetic predisposition to cancer.
After its promising rise, however, the company began seeing signs of trouble. Because users need to provide a DNA sample only once to use 23andMe’s services, the company failed to establish a sustainable business model based on repeat customers. Additionally, 23andMe struggled to license its tech to pharmaceutical companies, which could have boosted profits.
By the time the company filed for bankruptcy in March 2025, it had collected around 15 million DNA samples.
The attorney general has a separate, pending legal challenge in the U.S. Bankruptcy Court for the Eastern District of Missouri regarding the sale of Californians’ genetic information and material in bankruptcy.
