Skip to content
Sign in
Law & Justice · North America

23andMe reaches $6 million settlement in California breach lawsuit

California Attorney General Rob Bonta announced a $6 million settlement with 23andMe over allegations related to the company’s 2023 data breach. The breach affected nearly 7 million users across the United States, and Bonta said customers can delete their genetic data.

AI-assisted synthesis · Based on 5 outlets' reporting · Article text read from 1 of 5 outletsHow it's made

View timeline · 7 entries
5 outlets3 regionsLatest reporting 3 min read
Coverage: Mostly CenterL 1 · C 2 · R 0 · 2 unrated
Updat3 graphic: United States
Updat3 graphic

What happened

Key facts

  • California announced a $6 million settlement with 23andMe over its data breach (per mv-voice.com, the420.in, hipaajournal.com).
  • California Attorney General Rob Bonta announced the settlement (per mv-voice.com).
  • The settlement resolves allegations that 23andMe failed to protect customers’ personal information and genetic data after a 2023 security breach (per mv-voice.com).
  • The lawsuit alleged that unauthorized agents offered customers’ personal information and genetic data for sale on the “dark web.” (per mv-voice.com).
  • The lawsuit alleged that 23andMe misled customers about the breach’s severity (per mv-voice.com).
  • The breach affected nearly 7 million users across the United States (per mv-voice.com).
  • Bonta said 23andMe customers can delete their private genetic data regardless of who owns it (per mv-voice.com).
  • The 23andMe Research Institute acquired 23andMe’s assets in a bankruptcy auction and said it was a newly established independent nonprofit not involved in the lawsuit (per mv-voice.com).

The brief

California Attorney General Rob Bonta announced a $6 million settlement with 23andMe, resolving a lawsuit over allegations that the genetic-testing company failed to safeguard customers’ personal information and genetic data after a 2023 security breach.

The agreement concerns a breach that affected nearly 7 million users across the United States, according to the Mountain View Voice.

The lawsuit alleged that 23andMe did not adequately protect sensitive information and genetic data, which unauthorized agents then offered for sale on the “dark web.” It also accused the company of misleading customers about how severe the breach was. These are allegations addressed by the settlement; the outlet’s account does not report a court finding on them.

Bonta said the settlement was intended to protect Californians’ privacy rights and benefit consumers who had trusted the company. He also urged customers to delete their private genetic data, saying they could do so regardless of who owns it. The account does not describe a separate requirement for customers to take that step.

The Mountain View Voice reported that the 23andMe Research Institute acquired the company’s assets in a bankruptcy auction. In May, the institute told the outlet it was a newly established independent nonprofit and was not involved in the lawsuit.

Its acquisition of assets and its stated separation from the legal case are distinct points in the account; it does not say the institute entered the settlement. The settlement announcement followed a lawsuit that Bonta’s office had filed earlier in the year, according to the outlet. The account also says 23andMe changed its official name to Chrome Holding Co. last year.

It does not describe how that name change affects the settlement or the company’s obligations under it. The central practical guidance Bonta gave was that customers can delete their genetic data. The outlet does not provide a settlement payment schedule, details of any customer compensation process, or further terms of the agreement.

The other listed headlines likewise characterize the event as a California settlement for $6 million over 23andMe’s data breach or breach claims, without stating those additional terms.

Why it matters

  • Nearly 7 million U.S. users were affected by the breach, and the lawsuit concerned exposure of personal information and genetic data.
  • The lawsuit alleged that unauthorized agents offered the information and genetic data for sale online, making data protection and deletion directly relevant to affected customers.
  • California secured a $6 million settlement; Bonta said customers can delete their genetic data regardless of who owns it.

What to watch next

  • Whether 23andMe customers use the data-deletion option Bonta described.
  • How the $6 million settlement is implemented; the outlet’s account does not give payment or customer-compensation terms.
  • Whether the 23andMe Research Institute remains separate from the lawsuit, as it told the Mountain View Voice it was.

How it's being covered

Coverage analysisShow details
5 source articles · 5 unique outlets
Outlet political mix: Mostly Center· 1 Left · 2 Center · 2 unrated
Where the outlets are based: US/Canada 20% · Europe 20% · Other 60%
Outlet political mix
Mostly Center
Left
Center
Right
1 outlet
2 outlets
0 outlets
The marker shows coverage balance: each unique outlet counts once. 2 unrated outlets are not included.
Geography
Where the outlets covering this story are based.
5 unique outletsDominant coverage: US/Canada
How we measure coverage

How outlets' accounts compare

Updat3 does not yet have enough full reports to compare how outlets framed this story.

Timeline

Developments from this story's sources, dated background we compiled and fact-checked, and our earlier coverage. Each row says which.
  1. California enacted the Security Breach Information Act, requiring businesses to notify residents when specified personal information was exposed.
    Background · compiled and fact-checked by Updat3
  2. The DNA Relatives feature launched in 2011, linking test results across a growing customer database and making account security consequential for information about both account holders and their relatives.
    Background · from our historical context
  3. California signed the California Consumer Privacy Act, granting Californians rights over personal information held by covered businesses.
    Background · compiled and fact-checked by Updat3
  4. California enacted the Genetic Information Privacy Act, setting requirements for direct-to-consumer genetic testing companies.
    Background · compiled and fact-checked by Updat3
  5. In October 2023, 23andMe disclosed that attackers had accessed customer accounts using login credentials reused from other websites.
    Background · from our historical context
  6. The company said the attackers used those accounts to reach information available through features such as DNA Relatives and Family Tree; in December 2023, it said the breach had affected about 6.9 million people.
    Background · from our historical context
  7. In June 2024, California Attorney General Rob Bonta sued 23andMe, alleging inadequate safeguards and misleading statements about the breach.
    Background · from our historical context

How we got here

In October 2023, 23andMe disclosed that attackers had accessed customer accounts using login credentials reused from other websites. The company said the attackers used those accounts to reach information available through features such as DNA Relatives and Family Tree; in December 2023, it said the breach had affected about 6.9 million people.

In June 2024, California Attorney General Rob Bonta sued 23andMe, alleging inadequate safeguards and misleading statements about the breach. California’s 2002 Security Breach Information Act, enacted as Senate Bill 1386, requires businesses to notify California residents when specified personal information is exposed.

Original sources

1 of 5 articles · US/Canada · Show all

Every story links to the reporting it was built from. How we choose sources

Spotted a factual error, a broken link or a misleading summary? Tell us.