Trending Now - California Files Lawsuit Against 23andme Over Data Breach

WHO:

AP - California Attorney General Rob Bonta is suing 23andMe, a genetic testing company.

WHAT:

Yahoo - The lawsuit alleges that the breach exposed information of approximately 6.9 million U.S. customers.

Yahoo - The lawsuit alleges that 23andMe ignored numerous warnings that its systems had been compromised and downplayed the severity of the data breach, which exposed information about customers' health, genetic predispositions, biological relatives, ancestry, and ethnicity.

Yahoo - Bonta stated, "This data breach, and the company's handling of it, was entirely unacceptable."

Yahoo - The lawsuit was filed in San Francisco Superior Court.

Yahoo - The breach began in April 2023 and lasted about five months.

Yahoo - Approximately 856,000 Californians were affected by the data breach.

Yahoo - Bonta is seeking civil fines that could total "multiple millions" of dollars for violations of California's Genetic Information Privacy Act and state consumer protection laws.

Yahoo - The lawsuit was filed against Chrome Holding Co, the legal name for 23andMe.

Yahoo - The lawsuit came 14 months after 23andMe filed for bankruptcy in St. Louis.

Yahoo - A federal judge overseeing 23andMe's bankruptcy granted final approval for a $30 million to $50 million fund to resolve most U.S. customer claims from the data breach.

Yahoo - Last July, TTAM Research Institute, a nonprofit controlled by 23andMe co-founder Anne Wojcicki, bought 23andMe's assets for $305 million.

Yahoo - Bonta opposed the sale on privacy grounds, stating that California law gave consumers a right to consent to any transfer of their "most sensitive personal data."

AP - The lawsuit alleges that 23andMe failed to protect sensitive user data.

ABC News Tech - The data breach affected nearly 7 million people across the country.

WHERE:

AP - The lawsuit was filed in California.

WHEN:

Yahoo - 23andMe filed for Chapter 11 protection from creditors in March 2025.

AP - The data breach occurred in 2023.

WHY:

Yahoo - Bonta stated that "we would need to work through the bankruptcy (process) to collect any judgment."

Yahoo - Bonta acknowledged that "we would need to work through the bankruptcy (process) to collect any judgment."

BBC - Bonta stated that 23andMe "lied to consumers about the severity of its 2023 data breach."

ABC News Tech - The lawsuit claims negligence in protecting user data.

HOW:

Yahoo - The settlement also resolved accusations that 23andMe did not inform customers with Chinese and Ashkenazi Jewish ancestry that the hacker appeared to have targeted them and offered their information for sale on the dark web.

CNET - The attorney general described 23andMe's security measures as "lax" and stated that the company failed to adequately investigate warnings that its systems had been compromised.

AP - The lawsuit details the failure of 23andMe to implement adequate data protection measures.

(UPDATED May 29, 2026 21:32 UTC)

Yahoo is facing a lawsuit that claims a data breach exposed the personal information of about 6.9 million U.S. customers. California Attorney General Bonta noted that any potential judgment would need to be collected through the bankruptcy process. Additionally, the settlement addressed allegations that 23andMe failed to notify customers of Chinese and Ashkenazi Jewish ancestry that their information had been targeted by hackers and was being sold on the dark web.

(UPDATED May 29, 2026 10:16 UTC)

A lawsuit has been filed against 23andMe in San Francisco Superior Court, alleging that the company ignored warnings about a data breach that compromised sensitive customer information, including health and genetic data. California Attorney General Bonta criticized the company's handling of the situation as "entirely unacceptable," and noted that any potential judgment would need to be addressed through the bankruptcy process after 23andMe filed for Chapter 11 protection from creditors in March 2025. The settlement also addressed claims that 23andMe failed to notify customers of Chinese and Ashkenazi Jewish ancestry about the breach, which involved their information being offered for sale on the dark web.

(UPDATED May 29, 2026 06:20 UTC)

California Attorney General Rob Bonta has filed a lawsuit against Chrome Holding Co, the legal name for 23andMe, following a data breach that began in April 2023 and impacted approximately 856,000 Californians. Bonta is seeking civil fines that could reach "multiple millions" of dollars for violations of the state's Genetic Information Privacy Act and consumer protection laws, which comes 14 months after 23andMe filed for bankruptcy. A federal judge has approved a fund of $30 million to $50 million to resolve most U.S. customer claims related to the breach, while Bonta opposed the sale of 23andMe's assets last July on privacy grounds, emphasizing consumers' rights to consent regarding their sensitive personal data.

(UPDATED May 29, 2026 04:19 UTC)

The attorney general has criticized 23andMe's security measures, labeling them as "lax." He stated that the company did not properly investigate warnings indicating that its systems had been compromised. This revelation raises significant concerns about the protection of personal data in the genetic testing industry.

(UPDATED May 29, 2026 01:38 UTC)

A significant development has emerged as Bonta accused 23andMe of misleading consumers regarding the severity of its 2023 data breach. This statement was made during a report by the BBC, highlighting concerns over the company's transparency. As the situation unfolds, consumers are urged to stay informed about the implications of this breach.

(UPDATED May 28, 2026 23:25 UTC)

California Attorney General Rob Bonta is suing 23andMe, a genetic testing company, over allegations that it failed to protect sensitive user data. The lawsuit claims negligence in safeguarding this information, which reportedly affected nearly 7 million people across the country due to a data breach that occurred in 2023. Filed in California, the lawsuit details how 23andMe did not implement adequate data protection measures to prevent this incident.