California AG sues 23andMe over 2023 breach of 6.9M users

California Attorney General Rob Bonta has filed a lawsuit against the genetics testing company 23andMe, now legally known as Chrome Holding Co., over a 2023 data breach that exposed the sensitive personal and genetic information of nearly 7 million customers.

The lawsuit, filed in San Francisco Superior Court, alleges the company failed to implement reasonable security measures and then downplayed the severity of the incident. The breach began in April 2023 and lasted approximately five months before being discovered. Attackers initially accessed about 14,000 accounts through a credential-stuffing attack, using login information stolen from other websites, including the genealogy service MyHeritage. The hackers then exploited a feature within 23andMe's DNA Relatives tool to access data from a vastly larger pool of accounts, ultimately affecting an estimated 6.9 million users, including roughly 856,000 California residents.

Attorney General Bonta stated the company ignored multiple warnings and operated with security measures so lax that the intruders were able to move undetected within its systems for months. The company only began an investigation after hackers had already...