Ask Onix
California launches legal action over genetic data exposure
California Attorney General Rob Bonta announced plans to sue Chrome Holding, the successor to genetic testing company 23andMe, following an investigation into a 2023 data breach that compromised sensitive information of nearly seven million users.
Breach details and allegations
The probe revealed that 23andMe failed to implement fundamental security measures, leading to the exposure of genetic predispositions, health risk factors, ancestry details, and biological relatives' data. Bonta accused the company of misleading consumers about the severity of the breach.
A spokesperson for Chrome Holding has not yet responded to requests for comment.
Targeted data exploitation
Bonta highlighted that stolen data, including information about Asian American Pacific Islander (AAPI) and Jewish users, was later sold on the dark web. He described the incident as "disturbing and incredibly dangerous," particularly amid rising hate crimes against these communities.
The breach occurred through a "credential stuffing" attack, where hackers used passwords leaked in previous breaches to access 23andMe accounts with reused credentials.
International regulatory fallout
The incident triggered global scrutiny, including a £2.31 million fine from the UK's Information Commissioner's Office (ICO) last year. The ICO found that 23andMe violated UK data protection laws by failing to enforce adequate authentication measures, exposing the personal data of 155,592 UK residents.
Under UK law, genetic data is classified as a special category requiring heightened protections. The ICO's investigation, conducted alongside Canada's privacy commissioner, concluded that 23andMe's login process lacked sufficient safeguards.
User concerns and company response
23andMe faced further criticism last year when users reported difficulties deleting their accounts during its Chapter 11 bankruptcy proceedings. Some feared insurers might acquire their data to influence coverage decisions.
The company has since stated it has "made several binding commitments to enhance protections for customer data and privacy."
Background on 23andMe
Founded by Anne Wojcicki, sister of the late YouTube CEO Susan Wojcicki and former spouse of Google co-founder Sergey Brin, 23andMe once boasted high-profile clients like Snoop Dogg, Oprah Winfrey, and Eva Longoria. Its share price peaked above $300 before collapsing in 2024.
The company rebranded as Chrome Holding after filing for bankruptcy in 2025.
