Shocking Data Breach: California AG Sues 23andMe Successor

California Attorney General Takes Legal Action California Attorney General **Rob Bonta** has taken a bold step by filing a lawsuit against **Chrome Holding**, the successor of the well-known DNA testing company **23andMe**. This legal action comes after a thorough investigation revealed significant failings in how 23andMe handled sensitive customer data prior to its rebranding and bankruptcy in late 2022. The lawsuit, filed on Thursday, alleges that the company inadequately protected the personal information of nearly **seven million users**, leading to a significant data breach in **2023**.

Bonta stated, "Our investigation found that the company failed to take basic steps to protect users' data," further criticizing 23andMe for allegedly misleading consumers about the severity of the breach. "They lied to consumers about the severity of its 2023 data breach," he emphasized, highlighting the serious implications of such negligence.

The Breach's Impact: A Disturbing Revelation The ramifications of the breach are alarming. Users' genetic predispositions, risk factors, and sensitive information about biological relatives and ancestry were exposed. Notably, the **breached data** reportedly targeted specific ethnic groups, including **Asian American Pacific Islanders (AAPI)** and **Jewish individuals**. Bonta described this revelation as "disturbing and incredibly dangerous," especially during a time marked by increasing anti-Asian and antisemitic sentiments.

The breach occurred through a technique known as credential stuffing, where hackers exploited previously leaked passwords to access accounts on 23andMe. This tactic underscores the importance of robust security measures, as many users may have reused passwords across multiple platforms.

Regulatory Scrutiny and Previous Violations The fallout from the 2023 breach is not just limited to legal consequences; it has attracted **international regulatory scrutiny**. Previously, in **2022**, the company faced a fine of **£2.31 million** from the UK's **Information Commissioner's Office (ICO)** for inadequate data protection measures. The ICO's investigation, conducted alongside Canada's privacy commissioner, revealed that the personal data of **155,592 UK residents** was compromised due to poor authentication and verification processes.

Under UK law, genetic data is classified as a special category of data, necessitating enhanced protections because of its sensitive nature. This legal framework emphasizes the need for companies like 23andMe to implement stringent data security protocols.

Consumer Trust at Stake 23andMe's troubles didn't end with the breach. Following its **Chapter 11 bankruptcy filing** in 2022, users expressed frustration over the company's handling of account deletions. Concern grew that their genetic data could potentially be sold to insurance companies, which might use such information to influence coverage decisions. These fears reflect a broader issue of consumer trust in companies handling sensitive health data, particularly in light of recent events.

Founded by Anne Wojcicki, who is also the sister of the late Susan Wojcicki, former CEO of YouTube, 23andMe once boasted a roster of high-profile customers, including celebrities like Snoop Dogg, Oprah Winfrey, and Eva Longoria. At its peak, the company's stock soared past $300, but it has since plummeted to a fraction of that value by 2024.

The Future of Genetic Testing Companies As the lawsuit unfolds, the future of Chrome Holding and similar companies in the genetic testing industry remains uncertain. The increasing scrutiny from regulators and the potential for further legal action could reshape how these companies operate.

Why It Matters: The outcome of this case could set a critical precedent for how genetic data is handled in the future, influencing both regulatory frameworks and consumer trust in DNA testing services. Companies will need to prioritize data protection and transparency to regain user confidence and avoid severe penalties.

Looking ahead, stakeholders should keep an eye on potential legislative changes regarding data privacy, particularly how they might affect companies in the genetic testing sector. As public awareness of data breaches grows, consumer demand for accountability and security will likely increase, prompting companies to adopt more stringent safeguards.

In conclusion, the ongoing legal battle highlights the vital importance of protecting sensitive information in an age where personal data is a valuable commodity. The repercussions of this breach will echo through the industry, prompting a reassessment of data security practices and consumer rights in the realm of genetic testing.