The high-profile cyber incident impacted nearly 7 million 23andMe customers nationwide, with more than 855,000 of those affected residing in California alone. The sheer scale of the breach prompted an immediate investigation by the California Department of Justice, which was launched the same year the security lapse came to light. The newly announced settlement, which was filed in the U.S. Bankruptcy Court in the Eastern District of Missouri, remains pending final court approval.

In addition to addressing the security failures surrounding the 2023 breach, the multi-million-dollar agreement also successfully resolves a contentious appeal filed by the California Department of Justice. That appeal centered on the controversial sale of sensitive genetic information and biological samples during 23andMe’s subsequent bankruptcy proceedings, which took place without securing the explicit consent of the affected customers. Under the terms of the resolution, impacted consumers retain the vital right to request the complete deletion of their personal information and the physical destruction of their biological samples.

San Francisco-based 23andMe built its business model as a direct-to-consumer genetic testing service, inviting individuals to submit saliva samples for comprehensive DNA analysis. The company then stored this genetic information in extensive databases to provide customers with detailed reports concerning their ancestry, ethnic makeup, and genetic health predispositions. However, the company’s financial trajectory shifted dramatically in the years following the data breach, culminating in a bankruptcy filing in 2025.

During the bankruptcy proceedings, certain core assets—including the vast repositories of genetic data and collected biological samples—were sold to TTAM Research Institute. Notably, TTAM Research Institute is a nonprofit organization that was specifically established by the company’s co-founder and former chief executive officer.

The asset transfer triggered fierce opposition from state regulators. The California Department of Justice formally alleged that the sale directly violated the state’s Genetic Information Privacy Act. This state legislation explicitly mandates that companies must obtain the clear, affirmative consent of customers before selling or otherwise transferring their sensitive genetic information and biological samples to a third party.

Despite the state’s vehement objections, the initial challenges brought by the California DOJ were denied by both the bankruptcy court and the district court. These judicial setbacks ultimately set the stage for the ongoing legal appeal that has now been fully resolved through the comprehensive settlement agreement.

Independently from the bankruptcy asset dispute, the California DOJ also pursued separate legal action by filing a lawsuit against Chrome Holding Co. in state court. This lawsuit asserted that the company’s deficient data security practices directly contributed to the severity and reach of the 2023 breach. Furthermore, the state’s legal complaint alleged that the company had engaged in corporate misrepresentations that ultimately misled its customers and the wider public regarding the true safety and privacy standards of its digital platforms.

The newly brokered $6 million settlement brings a formal resolution to these pending claims and legal disputes between the corporate entity and the state of California. The complete settlement agreement has been officially entered into the records of the U.S. Bankruptcy Court in the Eastern District of Missouri, marking a major milestone in the ongoing fallout from the high-profile security and privacy failures that ultimately reshaped the genetic testing industry.