California’s Attorney General has sued 23andMe.
Actually it is Chrome Holding Co now. The consumer genetics giant formerly known for its mail-in DNA kits filed for bankruptcy in 2075. The lawsuit claims they left the door open for hackers. Specifically during the massive data breach of 2023. Nearly 7 million people lost their privacy. Ancestry. Health data. It all vanished into the dark.
Attorney General Rob Bonta filed suit in San Francisco Superior Court on Thursday.
He says the company ignored warnings. Repeated ones. The complaint alleges they failed to investigate properly when their systems were clearly compromised. They waited until the data was already for sale. A ransom was demanded. Only then did they start looking.
“23andMe’s security measures Were so lax that the threat actor Was able to operate undetected… for over five months”
Five months. That is a long time for thieves to walk around in your house.
The hack started in 2023 using a credential-stuffing attack. Cybercriminals threw stolen usernames and passwords from other breaches at the company’s servers. It worked. Over several months they lifted personal data from more than 6.9 million users.
It wasn’t random targeting either.
The company disclosed in October 2023 That hackers had specifically zeroed in on customers with Ashkenazi Jewish and Chinese ancestry. The timing was grim. This happened while hate and violence against these groups were rising.
“It is disturbing and incredibly dangerous.”
Over a million Asian-Pacific Islander users had their info posted online. For sale. Who would want this data? What would they do with it? The state of California certainly thinks the company should have done better to keep it safe.
There was a civil lawsuit in January 2024 too. It accused the firm of hiding the breach from targeted victims. That settled for $30 million. Cash out. Problem seemingly solved? Not according to AG Bonta.
23andMe has remained quiet. No comment.
It is strange to think about this company today. They were once the poster child for direct-to-consumer genetics. You paid $99. You spit in a tube. You found out about cousins and ancient roots. Their 2021 IPO raised billions. $3.5 billion in market optimism. Then things slowed down. Fast.
Last July Anne Wojcicki co-founder and former CEO led the TTAM Research Institute. They bought 23andMe’s assets. The price? $305 million. A fraction of what people once thought the company was worth.
Now they are in court again. For leaving 7 million people exposed. The data is still out there. The genetic profiles. The family trees. It all sits in the open. And no one seems to know if it has already been copied. Sold. Used.
It lingers. Unprotected. Like everything else these days. 🧬
