California Attorney General Rob Bonta said Monday that the state secured a $6 million settlement with Chrome Holding Co., formerly known as 23andMe.
The agreement, filed in U.S. Bankruptcy Court in the Eastern District of Missouri and pending approval, resolves allegations that the company failed to protect customers’ personal information and genetic data in a 2023 breach.
It also ends Bonta’s appeal after courts denied his objection to the sale of Californians’ genetic information and samples without affirmative consent.
Interest in DNA test kits peaked in 2021, driving the company’s market valuation to nearly $6 billion. Afterward, falling consumer demand affected major industry players, including 23andMe and its Blackstone-owned competitor, AncestryDNA.
Affected consumers retain the right to request deletion of their information and destruction of their samples.
The breach affected nearly 7 million customers nationwide, including more than 855,000 Californians.
Bankruptcy Sale and Prior Claims
The company filed for bankruptcy in March 2025 and sold certain assets, including genetic data and biological samples, to nonprofit TTAM Research Institute, a nonprofit established by the co-founder and former CEO of 23andMe.
The California Department of Justice objected, arguing the transfer violated the Genetic Information Privacy Act, which requires separate and explicit consent before sale or transfer of genetic data and samples.
Both the Bankruptcy Court and the District Court denied the objection.
Separately, the department sued Chrome Holding Co. in California state court over unreasonable data security practices that led to the breach and alleged misrepresentations.
“Given 23andMe’s reported financial distress, I remind Californians to consider invoking their rights and directing 23andMe to delete their data and destroy any samples of genetic material held by the company,” Bonta said in March 2025 before the company filed for bankruptcy.
Earlier Breach and Responses
The 2023 attack involved credential stuffing—a type of automated cyberattack in which attackers take lists of stolen username-and-password pairs (from previous data breaches, phishing, or dark-web dumps) and try them on other websites’ login pages, which led to the exposure of highly sensitive information.
“The threat actor used the compromised credential stuffed accounts to access the information included in a significant number of DNA Relatives profiles (approximately 5.5 million) and Family Tree feature profiles (approximately 1.4 million), each of which were connected to the compromised accounts,” the company said in a statement at the time.
A proposed class-action settlement filed in September 2024 offered $30 million to roughly 6.4 million American users.
“23andMe denies any wrongdoing whatsoever,” the company said, adding that further litigation would be “protracted, burdensome and expensive.”
In 2025, a company spokesperson told The Epoch Times in an emailed statement that “by the end of 2024, 23andMe had implemented multiple steps to increase security to protect individual accounts and information.”
Canada and the United Kingdom later fined the firm more than $4 million after a joint probe found inadequate safeguards against the credential-stuffing attack that ran from April to September 2023.
UK Information Commissioner John Edwards noted that “unlike usernames, passwords and email addresses, you can’t change your genetic makeup when a data breach occurs.”
Olivia Gomm contributed to this report.
