23andMe Agrees to $6 Million California Settlement Over Genetic Data Breach

23andMe’s former corporate entity, now known as Chrome, agreed to a proposed $6 million settlement with California over alleged cybersecurity failures that enabled a 2023 breach affecting approximately 6.9 million users, including 855,000 Californians. Attackers used reused passwords in a credential-stuffing attack to compromise about 14,000 accounts, then accessed information about millions of additional users through the DNA Relatives feature. The agreement remains subject to approval by the U.S. Bankruptcy Court in the Eastern District of Missouri and follows an $18 million settlement with 42 other state attorneys general in July.

The California agreement preserves affected consumers’ rights to request deletion of their information and destruction of their saliva samples, and resolves the state’s appeal concerning the sale of genetic information and samples during bankruptcy. After filing for bankruptcy in March 2025, 23andMe sold customers’ genetic data and saliva samples to TTAM Research Institute, a nonprofit established by former founder and CEO Anne Wojcicki. TTAM said it was not involved in the matters underlying the settlement and has no role in the agreement.