California Sues 23andMe Over Genetic Data Breach and Alleged Security Failures

California Attorney General Rob Bonta has sued 23andMe over its 2023 breach, alleging the DNA testing company failed to implement reasonable safeguards for highly sensitive customer data and misled consumers about the incident. State investigators said attackers used a credential-stuffing campaign against roughly 14,000 accounts over about five months, ultimately exposing the personal and genetic information of 6.9 million people, including 855,541 California residents. The compromised data reportedly included genetic predispositions, health risk factors, ancestry, ethnicity, and biological-relative information.

The complaint alleges 23andMe failed to defend against a well-known attack technique, overlooked warning signs such as spikes in login attempts and public discussion of the breach, and left additional weaknesses in its DNA Relatives feature. Bonta also said the stolen data was later advertised for sale on the dark web with references to Asian American Pacific Islander and Jewish users, heightening concerns about targeted harm. The lawsuit follows a class-action settlement approved in January 2026 for up to $50 million, and comes as California separately challenges the sale of consumers’ genetic data and biological samples in 23andMe’s bankruptcy case.