BreachPublished 29 May 2026

California Sues 23andMe, Alleging It Failed to Protect User Data in 2023 Breach

Source SecurityWeek

Description

Attorney General Rob Bonta filed the lawsuit against Chrome Holding Co., which 23andMe rebranded under after filing for bankruptcy last March. The post California Sues 23andMe, Alleging It Failed to Protect User Data in 2023 Breach appeared first on SecurityWeek .

Impact

The breach exposed sensitive genetic and health data of nearly 7 million customers, including raw DNA data and familial information. The attackers remained undetected for over five months, increasing the risk of misuse. The stolen data was sold on the dark web, potentially enabling identity theft, discrimination, or other harms. The breach disproportionately affected Asian-Pacific Islander and Ashkenazi Jewish users, raising concerns about targeted impacts amid social tensions. The incident resulted in legal action, including a lawsuit by California's Attorney General and a $50 million settlement in a class-action lawsuit. The breach highlights significant privacy violations and regulatory non-compliance.

Defensive guidance

Patch status is not applicable as this is a breach incident rather than a software vulnerability. The company failed to implement multifactor authentication and did not require password resets after the breach, which are standard security practices to mitigate credential stuffing attacks. Organizations handling sensitive genetic data should enforce multifactor authentication, monitor for suspicious login activity, and promptly respond to breach indicators. Consumers should be advised to use unique, strong passwords and enable multifactor authentication where available. Review and comply with applicable genetic data privacy laws. Since 23andMe filed for bankruptcy and rebranded, ongoing remediation and compliance status should be monitored through official channels.

Summary

The threat involves a 2023 data breach at 23andMe, where attackers used credential stuffing with stolen credentials from a 2017 MyHeritage breach to access approximately 14,000 accounts, compromising data of nearly 7 million users. The breach included raw genetic data, health reports, and familial information. 23andMe's security measures were insufficient, lacking multifactor authentication and failing to prompt password resets after the breach. The attackers operated undetected for over five months and eventually offered the data for sale on the dark web. The breach led to a lawsuit by California's Attorney General citing violations of privacy laws and inadequate protection of sensitive genetic information. The company has settled a class-action lawsuit related to the breach.

References

securityweek.com/california-sues-23andme-alleging-it-failed-to-protect-user-data-in-2023-breach/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 29 May 2026, 11:18 UTC

References

Community reviews