BreachPublished 29 May 2026

California AG sues 23andMe over 2023 breach exposing health data

Source Bleeping Computer

Description

California Attorney General Rob Bonta filed a lawsuit against 23andMe, now Chrome Holding Co., over the company's failure to protect sensitive customer genetic and personal information. [...]

Impact

The breach exposed highly sensitive genetic and personal data of millions of customers, including detailed health predisposition and biological relatives information. This exposure poses significant privacy risks to affected individuals and potential misuse of genetic data. The legal and regulatory consequences for 23andMe include lawsuits, multi-million-dollar fines, and bankruptcy. The incident undermines trust in the company's data protection practices and highlights vulnerabilities to credential-stuffing attacks and coding errors.

Defensive guidance

The company has faced legal and regulatory actions for failing to implement reasonable safeguards and detect intrusions. Organizations using similar services should ensure strong credential policies and monitor for credential-stuffing attacks. Customers should use strong, unique passwords and enable multi-factor authentication if available.

References

bleepingcomputer.com/news/security/california-ag-sues-23andme-over-2023-breach-exposing-health-data/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 29 May 2026, 18:18 UTC

References

Community reviews