Local
California secures $6.01 million agreement with 23andMe over genetic-data breach
The Bay Area genetic-testing company’s settlements tied to a 2023 breach now exceed $70 million, including payments to customers and states. The breach exposed information linked to 6.9 million people, including ancestry and family-tree details.
California Attorney General Rob Bonta has reached a $6.01 million settlement with 23andMe over a 2023 data breach that affected 6.9 million customers, bringing the company’s settlements related to the incident to more than $70 million.
The California agreement resolves the state’s claims over the breach and its objection to the transfer of 23andMe’s assets. It follows a $46.75 million class-action settlement finalized in July 2026 and an $18 million agreement involving attorneys general from 42 states.
“23andMe collected genetic data about millions of people and failed to meet its obligation to keep that information safe,” Bonta said earlier this month. He added that companies cannot avoid California’s consumer-protection and privacy laws by filing for bankruptcy.
The breach began around April 2023 and lasted about five months before the company disclosed it. Hackers used login credentials exposed in other data breaches to access some customer accounts. Through 23andMe’s DNA Relatives feature, which helps customers find genetic relatives, access to those accounts exposed information about additional users.
About 5.5 million customers who used DNA Relatives had information accessed, including names, birth years, ancestry reports, locations and genetic relationships. Another 1.4 million users had information from their Family Tree profiles exposed. The hackers initially advertised data allegedly associated with people of Ashkenazi Jewish and Chinese ancestry.
A multistate investigation later found that 23andMe lacked safeguards including mandatory multifactor authentication and adequate monitoring for suspicious logins. The company previously agreed to an $18 million multistate settlement that requires stronger security measures.
23andMe filed for Chapter 11 bankruptcy protection in March 2025, citing the breach and related lawsuits along with competition and declining demand for genetic testing. In June 2025, TTAM Research Institute, a nonprofit controlled by co-founder Anne Wojcicki, acquired the company’s assets for $305 million. California challenged the sale, arguing customers should have had to consent before their sensitive genetic data was transferred.
The $6.01 million agreement closes California’s claims and its challenge to the sale after months of litigation over whether the state could seek monetary penalties during the bankruptcy proceedings.