How the Breach Occurred and What Data Was Exposed
California Attorney General Rob Bonta announced on Monday that the state will receive a $6 million settlement from 23andMe’s bankruptcy proceedings. The payment resolves California’s legal claims tied to a 2023 data breach that exposed genetic and personal information of approximately 6.9 million customers. The breach compromised sensitive data including ancestry details and health-related genetic markers. California had previously attempted to block the $305 million sale of 23andMe’s assets, arguing the transaction could jeopardize consumer privacy protections during the company’s financial restructuring.
Breaking news
Ronna McDaniel Weighs In on GOP's Path Forward
Market Sentiment Shifts as S&P 500 Snaps Three-Day Losing Streak
Voters Demand Stronger Congressional Oversight of Presidential Power
Pelosi Looks Back, Sees Democratic Triumph AheadThe 2023 breach resulted from a credential stuffing attack where hackers used leaked passwords from other services to gain unauthorized access to 23andMe accounts. Once inside, attackers accessed profile information, genetic data, and family tree connections for millions of users. Over 855,000 customers had their DNA relatives’ information exposed, amplifying privacy risks beyond the account holders themselves. The state argued that 23andMe failed to implement adequate security measures despite storing highly sensitive biometric data, violating California’s Consumer Privacy Act and genetic information privacy laws.
Why California Challenged the Asset
California moved to halt the $305 million asset sale to prevent the transfer of customer data to new owners without enforceable privacy safeguards. The state contended that bankruptcy proceedings should not allow companies to sidestep obligations to protect consumer information, especially when dealing with immutable genetic data. Bonta emphasized that the settlement ensures funds are available to address potential harms while holding the company accountable for lax security practices. The agreement does not require 23andMe to admit wrongdoing but mandates specific data protection improvements as part of the bankruptcy resolution.
As part of the settlement terms, 23andMe must implement enhanced security protocols including multi-factor authentication, regular security audits, and stricter access controls for genetic data. The company is also required to provide affected customers with clearer transparency about how their data is used and stored. California officials will monitor compliance to ensure the promised safeguards are operational and effective. The settlement funds will be allocated to consumer protection initiatives and potential remediation efforts for impacted residents.
What Protections Are Being Required Moving Forward
What specific information was exposed in the 2023 breach? The breach exposed genetic profiles, ancestry data, health-related genetic markers, and personal details including names, email addresses, and birth dates. For over 855,000 customers, information about their DNA relatives was also accessed through the family tree feature.
Frequently Asked Questions
Will customers receive direct compensation from this settlement? The $6 million settlement payment goes to the state of California, not individual customers. However, the agreement requires 23andMe to improve security measures and may support future consumer protection programs that could benefit affected users.
How does this settlement affect 23andMe’s ongoing bankruptcy process? The settlement resolves California’s specific legal claims in the bankruptcy case but does not conclude the overall proceedings. 23andMe continues to restructure under Chapter 11, with this payment addressing one aspect of its legal liabilities related to the data breach.