23andMe Successor Pays $6M to Settle California Cybersecurity Allegations

Chrome Holding Company, the entity formerly known as 23andMe, has agreed to pay $6 million to resolve allegations from California Attorney General Rob Bonta. The settlement addresses claims that the company failed to adequately protect customers’ personal and genetic information. This failure enabled a significant data breach in 2023 that exposed sensitive details belonging to nearly 7 million individuals. The agreement is currently pending approval by the U.S. Bankruptcy Court in the Eastern District of Missouri.

Root cause

According to California Attorney General Rob Bonta, the root cause was a failure to meet obligations for keeping collected genetic data safe. Bonta stated that 23andMe collected genetic data about millions of people but did not effectively shield it. The allegations suggest that inadequate security measures allowed unauthorized access to this sensitive information. Bonta emphasized that companies cannot evade consumer protection and privacy laws by filing for bankruptcy.

Attack path

The attack path involved the exposure of sensitive personal and genetic information during a breach in 2023. Nearly 7 million people had their data compromised due to these security failings. The breach served as a final blow to the company’s standing in the genetic testing marketplace. While specific technical vectors are not detailed in the settlement announcement, the outcome was the widespread exposure of customer records.

Affected versions

The breach affected customer data held by 23andMe prior to its bankruptcy filing. In March 2025, 23andMe filed for bankruptcy and sold customers’ saliva samples and genetic data. The assets were acquired by the TTAM Research Institute, a nonprofit created by former founder and CEO Anne Wojcicki. The settlement applies to the data handled by the company before this transfer of assets.

Mitigation

• The settlement ensures affected consumers maintain the right to delete their data from the company's systems.
• Customers can order that their genetic samples be destroyed as part of the resolution terms.
• The $6 million payment resolves the specific allegations brought by the California Attorney General.
• The agreement is subject to approval by the U.S. Bankruptcy Court in the Eastern District of Missouri.

For customers and users

Users whose genetic data was involved should verify if they have received official communication regarding data deletion rights. Check whether your account settings allow for complete removal of personal profiles and associated genetic reports. Be alert for follow-up scams where attackers claim to offer data removal services for a fee. Legitimate companies do not charge for exercising statutory privacy rights. Monitor your credit reports for unusual activity, as genetic data breaches can sometimes precede identity theft attempts.

Background: Unauthorized access

Stop unauthorized access by enforcing strict identity verification, minimizing the data surface available to attackers, and continuously monitoring system integrity. This checklist covers identity controls, data protection, and network segmentation to reduce the risk of intrusions.

Read the full guide: Unauthorized Access Prevention Checklist for Systems

What to do and how to stay safe: 23andMe

• Review your privacy settings on any remaining genetic testing accounts to ensure data deletion options are active.
• Enable two-factor authentication on all accounts linked to the same email address or password as the affected service.
• Monitor financial statements and credit reports for unauthorized transactions or new credit inquiries.
• Watch for phishing emails claiming to be from the company or its successor, asking for personal verification details.

Step-by-step guide: Credit Freezes for Small Business: Protecting Employee Identities

General security guidance from the DarkWeb Headlines newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How much is the settlement with California?

Chrome Holding Company agreed to pay $6 million to resolve the allegations.

Who is the successor to 23andMe?

The TTAM Research Institute, a nonprofit created by Anne Wojcicki, acquired the samples and data.

Can customers delete their data after the breach?

Yes, the settlement ensures affected consumers maintain the right to delete their data and destroy samples.