California has reached a $6 million settlement with the company formerly known as 23andMe, resolving state claims over a major 2023 data breach that exposed sensitive personal and genetic information belonging to millions of customers.
California Attorney General Rob Bonta announced the agreement on October 19, 2026. The settlement involves Chrome Holding Co., the corporate entity formerly known as 23andMe, and addresses allegations that the company failed to adequately protect customer information and misled consumers about the security incident.
The agreement also resolves California’s legal challenge to the transfer of customer genetic data and biological samples during the company’s 2025 bankruptcy proceedings. Under the settlement, California will receive approximately $6 million for consumer relief, while the state has agreed to end its related legal challenges.
The agreement was filed in federal bankruptcy court and remained subject to court approval at the time of the announcement. Neither side admitted liability as part of the settlement.
The development is significant because genetic information differs from ordinary personal data: DNA can reveal information about ancestry, biological relationships and potential health risks, and it cannot simply be changed like a password after a security breach.
What Happened in the 23andMe Data Breach?
The controversy began in 2023, when hackers gained unauthorized access to 23andMe customer information.
The company disclosed the incident in October 2023. Investigators later found that attackers used a technique known as credential stuffing, in which stolen usernames and passwords from other services are used to access accounts where people have reused their login credentials.
According to the California Department of Justice, the breach affected nearly 7 million customers across the United States, including more than 855,000 California residents.
The compromised information included sensitive personal details and genetic-related data. Some information was subsequently offered for sale on the dark web.
A California investigation found that hackers were able to operate within the company’s systems for approximately five months without being detected. State officials alleged that the company’s security measures were inadequate and that its public communications misrepresented the severity of the incident.
The attorney general subsequently pursued legal action under California’s consumer-protection and privacy laws.
Why Is California Receiving $6 Million?
The settlement resolves claims brought by the California attorney general concerning the company’s data security practices and the handling of customers’ genetic information.
State officials alleged that 23andMe failed to take reasonable steps to protect sensitive information and misled consumers about the breach. The agreement also resolves California’s appeal concerning the transfer of genetic data and biological samples during bankruptcy.
The $6 million payment is intended to support consumer relief in California. It should not be confused with an individual payment that every affected customer will automatically receive.
The settlement also differs from the separate nationwide consumer class-action settlement involving people whose information was compromised in the 2023 incident.
California Attorney General Rob Bonta said the agreement reinforces the principle that companies cannot avoid state privacy and consumer-protection laws simply by entering bankruptcy.
The agreement resolves the state’s claims without an admission of liability by either party.
How 23andMe Went From a DNA Testing Pioneer to Bankruptcy
Founded in 2006, 23andMe helped popularize direct-to-consumer genetic testing in the United States.
The company allowed customers to mail saliva samples to its laboratories and receive reports about ancestry, genetic relatives and selected health predispositions. Its services attracted millions of customers interested in understanding their family histories and learning more about their DNA.
23andMe became a prominent name in consumer biotechnology and went public in 2021 through a merger with a special-purpose acquisition company. At its peak, the business was valued at approximately $6 billion.
However, the company faced significant commercial challenges. Customers generally did not need to purchase a new DNA test regularly, limiting repeat sales. Efforts to expand into pharmaceutical research and other revenue streams also failed to deliver a sustainable financial turnaround.
The 2023 data breach further damaged the company’s reputation and raised concerns about whether customers could continue trusting the business with their most sensitive information.
In March 2025, 23andMe filed for Chapter 11 bankruptcy protection, opening a new chapter in the dispute over its assets and the future of the genetic data it had collected.
The 2025 Bankruptcy Sale Raised New Privacy Concerns
During bankruptcy proceedings, 23andMe’s assets were sold to TTAM Research Institute, a nonprofit established by co-founder and former chief executive Anne Wojcicki.
The transaction, valued at approximately $305 million, included business assets as well as customer genetic data and biological samples.
The proposed transfer raised concerns among California officials and other state attorneys general about whether customers had provided the required consent for their genetic information to be transferred to a new owner.
California’s Genetic Information Privacy Act establishes protections for consumers who use direct-to-consumer genetic testing services, including requirements concerning the disclosure, use and transfer of genetic information.
Attorney General Bonta challenged the transfer, arguing that the transaction was inconsistent with California’s requirements for separate and explicit customer consent.
The bankruptcy court rejected California’s objection, and a federal district court also rejected the state’s appeal. The $6 million settlement now resolves California’s related challenge as part of the broader agreement.
The dispute highlights an important question for the biotechnology industry: how should companies protect customers’ genetic information when ownership changes through bankruptcy or a corporate acquisition?
What Does the Settlement Mean for 23andMe Customers?
The agreement does not mean that every affected customer will receive a share of California’s $6 million payment.
California says the settlement provides consumer relief for affected residents, while the separate class-action settlement has its own eligibility requirements and claims process.
People affected by the 2023 breach should distinguish between the state agreement and the nationwide class action. Eligibility, payment amounts and deadlines depend on the specific settlement and the person’s circumstances.
Customers should use official settlement information rather than relying on social media posts or unsolicited messages promising compensation.
The California attorney general has also reminded customers that they retain the ability to request deletion of their genetic data and destruction of stored biological samples through the applicable procedures. Customers can also withdraw permission for their genetic information to be used in research.
Because genetic information is particularly sensitive, people who no longer want their data stored should review the company’s current privacy settings and official instructions.
How the California Agreement Differs From the Nationwide Class Action
The California settlement is only one part of the legal fallout from the breach.
The nationwide consumer class-action proceeding is separate and addresses claims brought on behalf of eligible customers whose information was compromised. Its settlement provides a different process for compensation and other benefits.
The official class-action settlement website states that eligible participants may qualify for payments based on the type of claim they submit. These categories include certain health-information claims and extraordinary claims, subject to the settlement’s terms and approval process.
In addition, a separate agreement involving multiple states was reported in July 2026, under which Chrome Holding Co. agreed to pay $18 million in connection with the breach.
These agreements should not be added together and described as a single payment to consumers. They involve different parties, claims and distribution arrangements.
For affected customers, the relevant question is which settlement applies to their circumstances and whether they must submit a claim to receive compensation.
What Happens Next?
The California agreement was filed in the U.S. Bankruptcy Court for the Eastern District of Missouri and was awaiting court approval when announced.
Once the required approval and implementation steps are completed, California’s settlement will resolve the covered state claims under the agreement’s terms.
The broader privacy questions surrounding genetic testing will continue to matter beyond this case. Companies that collect DNA information face particular responsibilities because the data can reveal sensitive information not only about the individual who provided a sample but also about biological relatives.
The case also illustrates the challenges regulators face when a company holding highly sensitive personal information enters bankruptcy and its assets are transferred to another organization.
Conclusion
California’s $6 million settlement with Chrome Holding Co., formerly known as 23andMe, marks a significant development in the legal fallout from the 2023 genetic data breach.
The agreement addresses allegations that the company failed to protect customers’ sensitive information and resolves the state’s challenge to the transfer of genetic data during bankruptcy. It also reinforces the importance of privacy safeguards when businesses collect and store DNA information.
However, the state settlement is not the same as the nationwide consumer class action, and the $6 million should not be described as an automatic payment to every affected customer.
For consumers, the case is a reminder to review genetic-testing privacy settings, understand how personal information may be shared and use official channels to request data deletion or pursue compensation when eligible.
