California is taking the company once known as 23andMe to court over what it calls a deeply mishandled leak of genetic data. State Attorney General Rob Bonta on Thursday sued Chrome Holding Co., 23andMe’s post-bankruptcy successor, saying it failed to safeguard highly sensitive information—including health indicators, DNA profiles, and family connections—for millions of users, including roughly 855,000 Californians. The 2023 breach began with hackers using reused passwords linked to a breach at partner company MyHeritage, CBS News reports, then scraping data from 23andMe’s DNA Relatives feature.
About 7 million people were ultimately swept up, Bonta said, with some data later advertised on the dark web as belonging to Jewish and Asian American and Pacific Islander users as hate incidents were rising. The lawsuit accuses the company of ignoring known security gaps, playing down the scope of the breach, and violating multiple California privacy and consumer-protection laws, including the Genetic Information Privacy Act. The suit seeks various civil penalties against 23andMe and injunctions blocking the company from further violations of state privacy protection laws, per the AP.
