The troubles surrounding genetic testing company 23andMe are far from over. The company, now operating under the name Chrome Holding Co., has been hit with a major lawsuit from California Attorney General Rob Bonta over the massive cyberattack that exposed sensitive information belonging to millions of users.
The lawsuit centers on a 2023 security breach that reportedly affected around 7 million customers across the United States, including more than 850,000 residents of California. According to state officials, the company failed to adequately protect highly sensitive customer information despite collecting some of the most personal data imaginable, including genetic profiles, ancestry details, family connections, and health-related information.
The case adds another layer of scrutiny to a company that was once considered a pioneer in consumer DNA testing. What began as a popular service helping people discover their ancestry and genetic traits has now become a cautionary tale about the risks of storing large amounts of personal biological data online.
California Says Security Failures Left Users Exposed
At the heart of the lawsuit is the allegation that 23andMe failed to prevent a well-known cyberattack technique called credential stuffing. This method involves hackers using usernames and passwords stolen from previous breaches to gain access to accounts on other platforms where users may have reused the same login details.
California officials argue that a company handling genetic information should have been prepared for exactly this type of threat. The lawsuit claims that despite being aware of security concerns involving genealogy platform MyHeritage, 23andMe allegedly did not take adequate steps to stop customers from reusing compromised credentials.
The breach reportedly began with hackers accessing roughly 14,000 accounts. From there, investigators say the attackers exploited weaknesses in the company’s DNA Relatives feature, allowing them to gather information connected to millions of additional users.
Perhaps most concerning for regulators is the claim that hackers remained active within the system for months without detection. According to the lawsuit, the company only intensified its response after stolen information began appearing for sale on dark web marketplaces and ransom demands surfaced.
Sensitive Genetic Information Became a Major Concern
State officials also accuse the company of downplaying the seriousness of the incident when communicating with customers. The lawsuit alleges that 23andMe suggested some of the exposed information was already public through its DNA Relatives feature, while failing to fully explain the scope and sensitivity of the compromised data.
Authorities say the stolen dataset reportedly contained information connected to individuals from specific ethnic and religious communities, including Asian American, Pacific Islander, and Jewish users. Regulators argue that the timing made the breach particularly alarming due to growing concerns about targeted harassment and discrimination against those groups.
The legal battle arrives after a difficult period for the company. In March 2025, 23andMe filed for bankruptcy protection following years of financial struggles. The company also faced multiple lawsuits from affected users, with a federal judge earlier approving a reported $50 million settlement connected to the breach.
For privacy advocates, the case highlights growing concerns about how companies handle genetic information. Unlike a password or credit card number, genetic data cannot simply be changed after a breach. That reality has made the 23andMe incident one of the most closely watched data security cases in recent years.
As the lawsuit moves forward, California officials are seeking accountability over what they describe as failures to safeguard some of the most sensitive personal information a company can possess.
