Loading story…
California Attorney General Rob Bonta has sued 23andMe over its 2023 breach, alleging the DNA testing company failed to implement reasonable safeguards for highly sensitive customer data and misled consumers about the incident. State investigators said attackers used a credential-stuffing campaign against roughly 14,000 accounts over about five months, ultimately exposing the personal and genetic information of 6.9 million people, including 855,541 California residents. The compromised data reportedly included genetic predispositions, health risk factors, ancestry, ethnicity, and biological-relative information.
The complaint alleges 23andMe failed to defend against a well-known attack technique, overlooked warning signs such as spikes in login attempts and public discussion of the breach, and left additional weaknesses in its DNA Relatives feature. Bonta also said the stolen data was later advertised for sale on the dark web with references to Asian American Pacific Islander and Jewish users, heightening concerns about targeted harm. The lawsuit follows a class-action settlement approved in January 2026 for up to $50 million, and comes as California separately challenges the sale of consumers’ genetic data and biological samples in 23andMe’s bankruptcy case.
See the reporting duties and controls this puts on the clock.
5 events from the most recent confirmed update back to the earliest known activity.
A class action settlement over the breach, previously increased from an initial $30 million agreement to as much as $50 million, received final judicial approval in January 2026.
California Attorney General Rob Bonta filed suit against 23andMe, alleging violations of California privacy, data security, and consumer protection laws tied to the 2023 breach. The complaint says the company failed to implement reasonable protections and misled consumers about the severity and nature of the incident.
After the breach, threat actors sold the stolen 23andMe data on the dark web. The data was advertised as including information on Asian American Pacific Islander and Jewish users, heightening concerns about targeted harm.
In 2023, attackers used credential stuffing to gain unauthorized access to about 14,000 23andMe accounts over roughly five months. Through the company's DNA Relatives feature, the incident exposed personal and genetic information affecting about 6.9 million people, including 855,541 California residents.
The UK Information Commissioner's Office fined 23andMe £2.31 million for failing to protect UK users' genetic data in connection with the 2023 breach. This adds a separate UK regulatory enforcement action beyond the previously documented California lawsuit and class action settlement.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
14 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcemalwarebytes.com
Open sourcescworld.com
Open sourcehipaajournal.com
Open sourceblog.23andme.com
Open sourceico-newsroom.prgloo.com
Open sourceoag.ca.gov
Open sourceismg-cdn.nyc3.cdn.digitaloceanspaces.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A coalition of 42 U.S. state attorneys general reached an **$18 million settlement** with 23andMe over cybersecurity failures tied to the company’s 2023 breach, which exposed genetic and other personal information belonging to **6.9 million people**. Authorities said the company failed to defend against credential-based attacks, lacked adequate intrusion prevention, did not properly log and monitor for intrusions, failed to remediate known vulnerabilities, and did not investigate unusual login activity. The settlement also imposes new security and governance requirements on the **23andMe Research Institute**, which acquired the company’s assets, including genetic data, after its 2025 bankruptcy, while preserving customers’ rights to delete personal data and destroy genetic samples. In a related bankruptcy ruling, a U.S. judge held that **California cannot seek monetary damages** from the company formerly known as 23andMe because its Chapter 11 reorganization plan bars those claims, though the state may still pursue non-monetary remedies. The court said California had participated in the bankruptcy case and had an earlier opportunity to challenge jurisdiction, requiring the state to amend or dismiss its lawsuit to remove claims for civil fines. The bankruptcy process also created a customer claims fund, and the court has authorized **$46.75 million** in total payouts connected to the breach.
Aug 11, 2026
23andMe, now operating as Chrome Holding, has secured a $16.5 million settlement from its cyber insurers as part of its Chapter 11 bankruptcy proceedings. The agreement involves the insurers buying back unused cyber insurance coverage, with the funds earmarked to pay creditors whose claims are covered by the company's cyber policies, including those related to ongoing cyberattack litigation. The settlement also stipulates that Chrome will indemnify the insurers for claims up to the settlement amount and release them from further obligations related to the policies. The bankruptcy court approved the settlement, which is part of a broader restructuring that included the sale of 23andMe's Personal Genome Service and Research Services business lines to TTAM Research Institute for $305 million. Under TTAM's ownership, 23andMe continues to provide DNA health and ancestry testing services. The settlement provides a mechanism for addressing outstanding cyber-related claims as the company navigates its financial and legal challenges.
Jun 29, 2026
Labcorp agreed to pay **$35 million** to settle class-action litigation tied to the 2018–2019 cyberattack on its former billing vendor, American Medical Collections Agency, operated by Retrieval-Masters Credit Bureau. Labcorp said the incident affected nearly **10.3 million patients** whose personal information had been sent to AMCA and was present in the vendor’s systems between August 2018 and March 2019. Exposed data included **Social Security numbers**, payment card information, and in some cases medical test names and diagnostic codes. Under the proposed settlement, eligible class members can seek reimbursement of documented losses of up to **$5,000**, an estimated pro-rata cash payment of about **$50**, and **two years of medical and healthcare information monitoring**. Labcorp denied wrongdoing, and a final fairness hearing is scheduled in New Jersey federal court on Aug. 20. The AMCA breach affected roughly **24 million people** across dozens of clients, also hit Quest Diagnostics and BioReference Laboratories, contributed to AMCA’s 2019 bankruptcy, and previously led to a 2021 multistate settlement with **41 state attorneys general**.
Jun 29, 2026