23andMe Sued by California Over Massive 2023 Data Breach

California’s attorney general has filed a lawsuit against 23andMe, accusing the consumer genetics company of failing to protect sensitive personal information in a massive 2023 data breach that exposed the genetic and ancestry data of nearly 7 million customers. The suit alleges that 23andMe, now operating as Chrome Holding Co., ignored multiple warnings about system compromises and only began investigating after hackers demanded a ransom and offered the stolen data for sale on the dark web. The breach was carried out through a credential-stuffing attack, where cybercriminals used previously stolen usernames and passwords to access accounts over several months. The lawsuit highlights that 23andMe’s security measures were insufficient, allowing the intruders to remain undetected for more than five months. The breach particularly affected users of Chinese or Ashkenazi Jewish ancestry, with data from over 1 million Asian-Pacific Islander and Ashkenazi Jewish customers posted for sale online. Attorney General Rob Bonta emphasized the heightened risks posed by the breach amid rising anti-Asian American, Pacific Islander, and antisemitic hate crimes, calling the exposure of this data “disturbing and incredibly dangerous.” This legal action follows a previous lawsuit filed in January 2024, which accused 23andMe of inadequate protections and failure to notify affected customers promptly. That case was settled for $30 million. Once a leader in the direct-to-consumer DNA testing market, 23andMe’s reputation has been severely damaged by the breach and its aftermath, compounded by the company’s bankruptcy filing in 2025. The case underscores growing concerns over data security in the genetic testing industry, where highly personal information requires robust protection against increasingly sophisticated cyber threats.