California Sues 23andMe Over 2023 Data Breach That Affected 7 Million Users

California Attorney General Rob Bonta is suing 23andMe, now Chrome Holding Co., over a 2023 data breach affecting about 7 million users.

The state says the company failed to stop credential stuffing, left a site flaw unaddressed, and did not clearly warn customers about the sensitivity of the stolen data.

The exposed information included genetic and personal details, with some data later sold on the dark web.

The case underscores growing scrutiny of how DNA companies secure accounts, disclose breaches, and handle liability after major cyberattacks.