California has reached a $6 million settlement with the company formerly known as 23andMe, resolving legal claims arising from the genetic testing company’s 2023 data breach and a dispute over the transfer of customer data during its bankruptcy.
California Attorney General Rob Bonta announced the agreement with Chrome Holding Co., formerly known as 23andMe, after pursuing claims that the company failed to adequately protect customers’ personal information and genetic data.
The settlement, filed in the US Bankruptcy Court for the Eastern District of Missouri, remains subject to court approval.
The 2023 cyberattack exposed genetic and other personal information belonging to approximately 6.9 million 23andMe customers.
More than 855,000 Californians were affected.
The California Department of Justice launched an investigation following the breach and later alleged that 23andMe had failed to implement reasonable security measures to protect the highly sensitive information it held.
The state also accused the company of making misleading statements about its security practices and the circumstances surrounding the breach.
23andMe filed for bankruptcy in March 2025 following declining demand for its DNA testing services and legal fallout from the cyberattack.
The bankruptcy subsequently created a separate privacy dispute over what would happen to customers’ genetic information and biological samples.
Certain 23andMe assets, including customer genetic data and biological samples, were sold for $305 million to TTAM Research Institute, a nonprofit controlled by 23andMe co-founder Anne Wojcicki.
California challenged the transaction, arguing that transferring Californians’ genetic information and samples without their affirmative consent was inconsistent with the state’s Genetic Information Privacy Act.
A bankruptcy judge rejected California’s objection to the sale, and a federal district court subsequently rejected the state’s appeal.
The bankruptcy court also ruled that California could not pursue monetary recovery from the company’s successor over the breach.
Under the $6 million settlement, California will resolve its pending claims and drop further appeals concerning the bankruptcy sale.
The agreement does not remove consumers’ ability to control their own genetic information.
California residents retain the right to request deletion of their genetic data and destruction of biological samples held by the company.
Bonta said companies handling genetic information remained subject to California’s consumer protection and privacy laws even when entering bankruptcy.
The California agreement is separate from compensation for people affected by the cyberattack.
A US bankruptcy judge approved a $46.75 million settlement for victims of the 2023 data breach in July 2026.
The case highlights the unusual privacy questions that can arise when businesses holding highly sensitive personal information enter bankruptcy.
Unlike many corporate assets, genetic information can reveal details about an individual’s ancestry, biological relatives and health predispositions, creating significant questions about how such information can be transferred when a business changes ownership.
California ultimately failed to prevent the sale of 23andMe’s assets to TTAM Research Institute.
However, the $6 million settlement resolves the state’s remaining claims and appeals while preserving consumers’ rights to request that their genetic information be deleted and biological samples destroyed.