23andMe successor to pay California $6 million over 2023 breach

Past-week coverage · Original source published 2026-10-20.

California Attorney General Rob Bonta announced a settlement under which 23andMe's successor will pay the state $6 million to resolve allegations that the company did not properly protect customers' personal and genetic data before a 2023 breach. The breach exposed sensitive information belonging to nearly 7 million people, according to the announcement.

The settlement is pending approval by the U.S. Bankruptcy Court in the Eastern District of Missouri. Under its terms, affected consumers keep the right to delete their data and to order that their genetic samples be destroyed.

The entity settling is Chrome Holding Company, formerly known as 23andMe, Inc. Anne Wojcicki, 23andMe's founder and former CEO, is its CEO. 23andMe filed for bankruptcy in March 2025 and sold customers' saliva samples and genetic data to the TTAM Research Institute, a nonprofit she created. A TTAM spokesperson said the institute is newly established, independent, and "not involved in matters related to Chrome Holding Co." and has no role in the settlement. Chrome Holding Company had no personnel authorized to speak to media, a staffer said.

Bonta said companies "cannot evade California's consumer protection and privacy laws by filing for bankruptcy." In July, 23andMe settled with a coalition of 42 other state attorneys general for $18 million.

For defenders, the case is a reminder that genetic and health data carries long-lived risk: retention limits, deletion rights and sample destruction are the controls regulators focused on here.