23andMe successor agrees to pay California $6 million over 2023 data breach

Chrome Holding Company, the holding company formerly known as 23andMe, has agreed to pay California $6 million to resolve allegations that it failed to effectively protect customers' personal and genetic data, The Record reported on October 20. California Attorney General Rob Bonta announced the settlement on Monday. It stems from a 2023 breach that exposed sensitive information belonging to nearly 7 million people and underlines that companies in bankruptcy remain answerable for past security failures.

What happened

According to The Record, the settlement resolves California's claims over the company's handling of customer data before and during the 2023 incident. The article does not describe how the attack was carried out.

Bonta said in his announcement that 23andMe "collected genetic data about millions of people and failed to meet its obligation to keep that information safe." He added that companies "cannot evade California's consumer protection and privacy laws by filing for bankruptcy."

Settlement terms

Under the agreement, affected consumers keep the right to delete their data and to have their genetic samples destroyed, according to The Record. The settlement still requires approval from the U.S. Bankruptcy Court for the Eastern District of Missouri, where the company's bankruptcy case is being handled.

The Record notes that the company had already settled with a coalition of 42 other state attorneys general for $18 million in July.

Background

23andMe filed for bankruptcy in March 2025 and sold customers' saliva samples and genetic data to the TTAM Research Institute, a nonprofit created by former founder and CEO Anne Wojcicki, who is also CEO of Chrome Holding Company. A TTAM spokesperson told The Record that the institute is not involved in matters related to Chrome Holding Company and had no role in the settlement. A staffer at Chrome Holding said the company has no personnel authorized to speak to the media.

According to the report, 23andMe's business had been declining as demand for genetic testing shrank, and the data breach proved to be the final blow.

Why it matters

Genetic data cannot be changed after it is exposed, which makes breaches of such information especially damaging for the people affected. The California case shows regulators continuing to pursue enforcement even after a company has collapsed and sold its core data assets. Former 23andMe customers who want their information removed should use the deletion rights preserved under the settlement once it is approved.