California AG sues 23andMe successor over 2023 genetic data breach

California Attorney General Rob Bonta has filed a lawsuit against the successor company to 23andMe, alleging the firm misrepresented the severity of a 2023 data breach. The breach exposed sensitive genetic and personal information of millions of users. Bonta claims the company deliberately downplayed the incident's scope.

California Attorney General Rob Bonta has launched legal action against the successor company to collapsed genetics firm 23andMe, accusing it of misleading consumers about the true scale of a 2023 data breach that compromised highly sensitive genetic information.

The lawsuit centers on allegations that the company was not transparent with affected users about how serious the breach actually was. Genetic data is among the most personal information a company can hold, as it cannot be changed or reset like a password, making any exposure potentially permanent.

23andMe, once a pioneer in consumer DNA testing, filed for bankruptcy earlier this year after years of financial difficulties. A successor entity has since taken over its assets and data holdings, raising significant concerns among privacy advocates about who now controls the genetic profiles of millions of people.

The 2023 breach was initially disclosed by 23andMe but critics and investigators argued the company minimized its impact. Bonta's office contends that this alleged misrepresentation constitutes a violation of California's consumer protection and data privacy laws, which include some of the strongest such protections in the United States.

The case highlights growing legal scrutiny of how companies handle — and communicate about — large-scale data breaches, particularly when the information involved is as sensitive as genetic profiles. It also raises broader questions about what happens to personal biometric and genetic data when companies fail or change hands.