California Attorney General Rob Bonta filed a lawsuit against 23andMe, now operating as Chrome Holding Company, over a 2023 data breach that compromised the personal and genetic data of nearly 7 million users nationwide, including more than 855,000 Californians. The breach occurred when hackers used 'credential stuffing'—leveraging stolen login data from a prior MyHeritage breach—to infiltrate accounts and exploit a vulnerability in 23andMe’s 'DNA Relatives' feature.

Investigators found that attackers remained undetected in the system for about five months. The stolen data included sensitive details such as ancestry, genetic predispositions, health risk factors, and biological relatives. Shockingly, data from one million users was later advertised for sale on the dark web, with specific targeting of Asian American, Pacific Islander, and Jewish individuals.

California alleges that 23andMe failed to implement basic cybersecurity safeguards and misled consumers about the breach’s severity. The company reportedly paid a $400,000 cryptocurrency ransom to hackers in exchange for the destruction of stolen data and information about security flaws. The lawsuit cites violations of multiple state laws, including the Genetic Information Privacy Act and the California Consumer Privacy Act.