23andMe successor settles with California for $6 million over cybersecurity failings

A holding company formerly known as 23andMe has agreed to pay California $6 million to resolve allegations that it did not effectively shield customers’ personal and genetic data, enabling a massive 2023 breach that exposed sensitive information belonging to nearly 7 million people.

The settlement is pending approval by the U.S. Bankruptcy Court in the Eastern District of Missouri and ensures affected consumers maintain the right to delete their data and order genetic samples be destroyed, according to a press release Monday from California Attorney General Rob Bonta.

In March 2025, 23andMe filed for bankruptcy and sold customers’ saliva samples and genetic data to the TTAM Research Institute, a nonprofit created by 23andMe’s former founder and CEO Anne Wojkicki.

In addition to running 23andMe, Wojcicki is the CEO of the Chrome Holding Company, the entity that settled with Bonta.

A spokesperson for TTAM said in a statement that the organization is a “newly established independent nonprofit organization and is not involved in matters related to Chrome Holding Co., formerly known as 23andMe, Inc.” 

“The institute was not involved in the matters and has no role in the settlement.”

Chrome Holding Company does not have any personnel authorized to speak to the media, according to a staffer answering the phone.

23andMe was a longtime Silicon Valley juggernaut, but its fortunes waned over time as the marketplace for people seeking genetic testing shrank.The data breach dealt the final blow.

“23andMe collected genetic data about millions of people and failed to meet its obligation to keep that information safe,” Bonta said. “Companies cannot evade California’s consumer protection and privacy laws by filing for bankruptcy.”

In July, 23andMe settled with a coalition of 42 additional state attorneys general for $18 million.