Rob Bonta, attorney general of California, said on Thursday that he is suing Chrome Holding, the legal name for 23andMe, alleging the genetic-testing company failed to protect the sensitive data of millions of users.
Although 23andMe, which Bonta’s office referred to as “the first and one of the largest direct-to-consumer genetic testing companies in the world,” said it was committed to data privacy and transparency, its data from almost 7 million American users, including 855,541 Californians, was breached in 2023.
“In truth, it failed to take reasonable measures to protect its customers’ most sensitive data, ignored known vulnerabilities in its systems, and failed to properly investigate or respond to numerous warnings that its systems had been compromised,” Bonta’s office said.
“23andMe collected genetic data about millions of people, failed to meet its obligation under California law to keep that information safe and then lied to consumers about the severity of its 2023 data breach,” the attorney general said.
“Our investigation found that the company failed to take basic steps to protect users’ data—data including the sensitive personal information, family histories and health conditions of consumers,” he said.
“The sale of this data on the dark web took place amidst a period of mounting anti-Asian American and Pacific Islander and antisemitic hate and violence, and explicitly called attention to the deeply personal and identifying nature of that information,” he added. “This is disturbing and incredibly dangerous.”
The data breach only “came to light after the data of one million consumers were offered for sale on the dark web, specifically touting that the data belonged to Asian American and Pacific Islanders and Jewish users,” according to Bonta’s office.
“Disturbingly, this occurred during a period of increasing anti-AAPI and antisemitic hate and violence,” it said.
