23andMe successor settles with California for $6 million over cybersecurity failings
California Attorney General Rob Bonta announced a settlement under which 23andMe’s successor will pay $6 million to resolve allegations that the company did not properly protect customers’ data before a 2023 breach.
A holding company formerly known as 23andMe has agreed to pay California $6 million to resolve allegations that it did not effectively shield customers’ personal and genetic data, enabling a massive 2023 breach that exposed sensitive information belonging to nearly 7 million people.
The settlement is pending approval by the U.S. Bankruptcy Court in the Eastern District of Missouri and ensures affected consumers maintain the right to delete their data and order genetic samples be destroyed, according to a press release Monday from California Attorney General Rob Bonta.
In March 2025, 23andMe filed for bankruptcy and sold customers’ saliva samples and genetic data to the TTAM Research Institute, a nonprofit created by 23andMe’s former founder and CEO Anne Wojkicki.
In addition to running 23andMe, Wojcicki is the CEO of the Chrome Holding Company, the entity that settled with Bonta.
TTAM did not immediately respond to a request for comment. Chrome Holding Company does not employ anyone authorized to talk to the press.
23andMe was a longtime Silicon Valley juggernaut, but its fortunes waned over time as the marketplace for people seeking genetic testing shrank.The data breach dealt the final blow.
“23andMe collected genetic data about millions of people and failed to meet its obligation to keep that information safe,” Bonta said. “Companies cannot evade California’s consumer protection and privacy laws by filing for bankruptcy.”
In July, 23andMe settled with a coalition of 42 additional state attorneys general for $18 million.
